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Every  day.  Verizon  CIO  SHAYGAN  KHERADPIR  thinks 
about  “how  can  we  go  there  faster.  Every  night,  I  think  we 
can  do  more,  do  more,  do  more." 
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Your  potential.  Our  passion.  " 

Microsoft 


"The  new  system  integrates  thousands  of 
pieces  of  data  in  real  time.  Store  managers 
love  it,  executives  love  it — everyone  loves  it." 

Robert  Fort 

Director  of  IT,  Virgin  Entertainment  Group,  North  America 


Microsoft  Windows  Server  System  makes  it  easier 
for  Virgin  Entertainment  Group,  North  America 
to  make  inventory  decisions  based  on  real-time 
data  from  its  sales  counters.  Here's  how:  By 
building  a  business  intelligence  solution  using 
SQL  Server  supported  by  BizTalk  Server  and  the 
.NET  Framework,  Virgin  is  able  to  gather  the 
Point  of  Sale  and  traffic  data  collected  in  its  stores, 
analyze  it,  and  have  reports  to  store  managers 
every  15  minutes.  Software  that's  easier  to  integrate 
is  software  that  helps  you  do  more  with  less.  To  get 
the  full  Virgin  story  or  find  a  Microsoft  Certified 
Partner,  go  to  microsoft.com/wssystem 


Windows  Server  System™  includes: 


Server  Platform 

Windows  Server” 

Virtualization 

Virtual  Server 

Data  Management  &  Analysis 

SQL  Server” 

Communications 

Exchange  Server 

Portals  &  Collaboration 

Office  SharePoint*  Portal  Server 

Integration 

BizTalk*  Server 

Management 

Systems  Management  Server 

Microsoft"  Operations  Manager 

Security 

Internet  Security  &  Acceleration  Server 

Plus  other  software  products 


f-  ^005  Microsoft  Corporation..  All  rights  reserved.  Microsoft,  JSfcfaJk,  Share  Point,  SQL  Server,  the  Windows  logo,  Windows  Server,  Windows  Server  System,  and  "vour  potential.  Our  passion."1  are  either  registered 
trademarks  or  trademarks  of  Mfcrosoft  Corporation  in  the  .United  States  and/or  other  countries.  The  names  of  actual  companies  and  products  mentioned  herein  may  be  the  trademarks  of  their  respective  owners. 


NAME 


Mr.  400,000  SKUs  and 
7.5  Million  Transactions 
Analyzed  In  Real  Time 


MEGASTORE 


©2005  Intel  Corporation.  Intel.  Intel  Inside,  the  Intel  Inside  logo,  and  Intel  Xeon  are  trademarks  or  registered  trademarks  of  Intel  Corporation  or  its  subsidiaries  in  the  United  States  and  other  countries.  All  rights  reserved- 


The  world’s  most-deployed  server  platform  now  supports 
64-bit  applications.  The  Intel®  Xeon"  processor  now 
works  harder  for  your  business  than  ever.  With  innovative 
platform  features  that  enable  power-saving 
options,  flexible  memory,  I/O  and  storage  configurations. 
And,  of  course,  continued  support 
for  all  your  existing  32-bit  applications. 

How  can  Intel  Xeon  processor-based  servers  serve  you? 


Knowing  is  more  than  processing  information,  it's  being  able  to  grasp  it  with  clarity  and 
certainty,  and  put  it  to  work. The  complexity  of  today's  enterprises,  the  multiplicity  of  sources 
and  the  constant  changes  in  hardware,  software  and  regulations  makes  knowing  —  critical. 

NetlQ  Security  Management  is  the  only  way  to  secure  assets,  assure  compliance  and  manage 
risk.  Our  knowledge-based  software  solutions  are  intelligent  and  simple  to  use.  Only  NetlQ, 
a  leader  in  systems  and  security  management,  gives  you  the  assurance  of  knowing  that  no 
critical  system  is  unprotected,  that  your  enterprise  is  secure,  available  and  performing. 

©  Copyright  2005  NetlQ  Corporation.  All  rights  reserved.  NetlQ  and  the  NetlQ  logo  are  registered  trademarks  of  the  NetlQ  Corporator i. 


FREE... 

Directory  Assistance 
Available  on  Your  Website 

If  you  have  a  website  and  you  are  not  offering  Directory  Assistance, 
you  are  missing  out  on  a  valuable  service  needed  by  your  site  users. 


Only  fonecart.com ™  provides 
phone  numbers  and  addresses, 
plus  exclusive  information  not 
available  with  phone  company 
directory  assistance  or  other 
popular  websites. 

220  Million  People 

•  Estimated  Household  Income 

•  Years  at  Address 

•  Dwelling  Type 

•  Estimated  Home  Value 

14  Million  Businesses 

•  Phone  Number 

•  Address/Location 

•  Years  in  Business 

•  Name  of  Owner 


We  can  offer  FREE  Directory  Assistance  to  your  users. 

We  will  even  create  a  Private  Label  for  you  so  your  users  will  think  it’s 
offered  by  you.  And,  the  best  part  is,  it’s  FREE  and  no  charge  to  you! 


fonecart.com ™ 

Call  David  Schajatovic  at  866.594.3221 
and  receive  a  FREE  30-Day  Trial! 


fone cart  .com 

a  division  of  infoXJSX 


5711  S.  86th  Circle  Phone:  866.594.3221 

PO  Box  27347  Fax:  650.389.0707 

Omaha,  NE  68127  www.fonecart.com 
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Three  CIOs,  three  challenging  environ¬ 
ments,  three  strategic  agendas.  For  a 
reality  check  of  what  it  takes  to  innovate 
in  2005,  we  spent  time  with  (from  top 
to  bottom)  SHAYGAN  KHERADPIR  at 
Verizon,  KEN  ERDNER  at  Old  Dominion 
Freight  Lines  and  ROBERT  TAYLOR  in 
Fulton  County,  Ga. 


Special  Report: 

The  State  of  the  CIO 

REALITY  CHECK  |  42 

Faced  with  a  mandate  to  cut  costs  while  creating 
competitive  advantage,  CIOs,  according  to  new 
CIO  research,  have  placed  their  emphasis  on 
innovation.  Feature  by  Elana  Varon 

SLEEPLESS  IN  MANHATTAN  |  52 

The  pressure  to  develop  new  products  and 
services  for  Verizon  never  lets  up.  And  neither 
does  its  CIO.  Feature  by  Alice  Dragoon 

EVERYONE  WANTS  SOMETHING 
FROM  KEN  |  62 

Old  Dominion  Freight  Lines’  CIO  is  competing 
against  companies  with  more  money  and  man¬ 
power  than  he  has.  So  he  has  to  work  harder  and 
smarter  than  they  do.  Feature  by  Stephanie  Overby 

WHERE  THERE’S  A  PERSON, 

THERE’S  A  PROBLEM  |  70 

Like  it  or  not:  When  you’re  a  public-sector  CIO, 
the  public  will  have  a  lot  to  say  about  everything 

you  do.  Feature  by  Allan  Holmes 


THE  IDEAL  AND  THE  REALITY  |  81 

A  guide  for  building  the  most  effective  CIO 
position  possible,  and  a  test  to  assess  the  state 
of  your  own  role.  Feature  by  The  Editors 

THE  REAL  AND  IDEAL  |  10 

It’s  great  to  set  stretch  goals  that  help  us  grow— as 
long  as  we  understand  that  perfection  is  not 
attainable.  Column  by  Abbie  Lundberg 

INNOVATION:  FULL  DISCLOSURE  |  CIO.COM 

Learn  how  CIOs  can  best  allocate  their  innovation 
dollars  in  our  “IT-Innovation  Survey”  at 

www2.cio.com/research.  Also  see  more  insights 
on  how  IT  drives  business  innovation  in  the 
new  “Special  Report:  Innovation.”  Find  the  link 

at  www.cio.com/040105. 
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Repeal  Sarbanes-Oxley  i  American  companies 
are  spending  valuable  resources  on  compliance 
rather  than  competition.  By  Gary  Beach 
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Even  perfect  execution  won’t  lead  to  perfect  IT.  You  must  encourage  business 
users  to  develop  some  IT  smarts  of  their  own.  Column  by  Susan  Cramm 

Communication 

MASTERING  THE  SECRET  ETIQUETTE  OF  GOLF  |  98 

Tiger  Woods  may  have  nothing  to  fear  from  you,  but  you  still  have  to  know 
the  (unwritten)  rules  of  the  game.  Feature  by  Thomas  Wailgum 

Customer  Service 

THE  PRICE  OF  NICE  |  38 

Machines  are  cheaper,  but  people  are  sweeter.  Someday,  only  the  rich  will 
be  privileged  enough  to  deal  with  human  beings.  The  poor  will  be  forced  to 
use  technology.  Column  by  Megan  Santosus 

Economic  Trends 

THE  PERSONALIZED  ECONOMY  |  32 

Mass  production  has  hit  a  dead  end.  Today’s  consumers  increasingly 
expect  individualized  attention.  CIOs  can  help  their  companies  understand 
this  shifting  economic  landscape.  Column  by  Shoshana  Zuboff 

Organizational  Change 

JOURNEY  TO  THE  I.T.  PROMISED  LAND  |  91 

How  one  CIO’s  budgeting  blues  led  to  an  organizational  revamp  at 
Assemblies  of  God.  Feature  by  Alice  Dragoon 
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THE  ONLY  BI  STANDARD 

BUILT  TO  TOMORROW’S 
SPECIFICATIONS. 


Standardize  your  reporting  and  analysis  on  Cognos. 

The  only  comprehensive  Business  Intelligence  solution 
built  on  a  single,  services-oriented  architecture. 

Instead  of  outdated  technologies  cobbled  together. 

A  completely  web-based  solution  designed  to  be  globally  deployable.  Truly  scalable. 
And  an  integral  part  of  a  performance  management  solution 
that  includes  planning,  budgeting,  and  scorecarding. 

It’s  what  you’ll  demand  from  BI  years  from  now. 

And  it’s  already  working  in  86  of  the  Fortune  100  companies  today. 

No  wonder  industry  analysts  call  Cognos  a  clear  leader  in  BI. 


Bring  the  future  of  BI  to  your  company. 

Visit  the  Cognos  Standardization  Resource  Center 
at  Cognos.com/leader  today. 


Copyright  ©  2004  Cognos  Incorporated.  All  rights  reserved. 
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THE  NEXT  LEVEL  OF  PERFORMANCE’ 


The  Real 
and  Ideal 


It’s  great  to  set  stretch  goals 
that  help  us  grow— as  long 
as  we  understand  that 
perfection  is  not  attainable 
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I've  been  thinking  a  lot  lately  about  the  difference  between  the  ideal  and  the  real. 

While  CIOs— universally  under  pressure— recently  have  been  asking  us  to  inspire  them 
by  providing  more  encouraging  stories  about  IT’s  positive  impact  on  the  enterprise,  we’re 
pretty  sure  that  what  you  don’t  want  are  sugarcoated,  idealized  pictures  set  in  a  world 
that  no  living,  breathing  executive  would  ever  recognize.  While  too  many  dark  stories  of 
projects  gone  awry  or  spending  getting  out  of  control  will  make  readers  cringe,  puffed-up 
tales  of  technological  derring-do  are  equally  demoralizing.  What’s  wrong  with  me?  they  may 
make  you  ask.  Why  can’t  I  be  as  wonderful  as  that  guy?  (As  the  mother  of  two  teenage  daugh¬ 
ters,  I  witness  this  collision  of  private  reality  and  public  hype  every  day.) 

This  is  not  to  say  that  the  ideal  doesn’t  have  its  place.  Defining  an  ideal  can  help  the  seeker 
to  set  goals,  to  stretch— as  long  as  it’s  understood  that  the  ideal  is  not  actually  attainable  and 
that  the  reality  (the  good,  the  bad  and  the  ugly) 
is  the  ocean  in  which  we  swim  every  day. 

That’s  the  setting  for  this  special  look  at 
the  state  of  the  CIO.  We  wanted  to  take  every¬ 
thing  we’ve  learned  from  poring  over  our 
research  of  the  past  year,  along  with  hun¬ 
dreds  of  in-person  interviews,  and  filter  it  through  our  17  years  of  reporting  on  the  CIO  posi¬ 
tion  to  create  the  ultimate  and  definitive  description  of  the  CIO  role.  At  the  same  time,  we 
wanted  to  show,  in  a  very  real  and  human  way,  what  life  is  really  like  for  three  very  different 
CIOs  (please  see  “State  of  the  CIO  2005:  Reality  Check,”  Page  42). 

In  the  process,  we  explode  some  stereotypes.  For  instance,  CIOs  at  technology-driven, 
richly  funded  companies  don’t  spend  all  their  time  in  a  corner  office  plotting  strategies;  they 
also  work  incredibly  long  hours  and  personally  wrestle  problems  to  the  ground  on  a  daily 
basis.  On  the  other  hand,  public-sector  CIOs  indeed  are  resource-constrained,  but  they’re 
under  just  as  much  pressure  to  innovate  as  any  private-sector  IT  exec.  And  midsize  com¬ 
panies  that  compete  for  business  against  industry  leaders  will  settle  for  less  at  their  own 
peril  when  it  comes  to  leveraging  IT. 

To  tie  together  the  ideal  and  the  real,  we’ve  created  a  self-assessment  tool  so  that  you 
can  compare  yourself  to  our  ultimate  job  spec.  And  knowing  that  few  will  achieve  a  per¬ 
fect  score,  we’ve  included  tips  for  improving  your  situation,  with  links  to  related  articles 
from  the  CIO  archives. 

No  one’s  perfect,  but  that’s  to  be  expected.  There’s  always  room  for  improvement.  And 
that,  in  reality,  is  not  a  bad  thing. 


CIOs  recently  have  been  asking 
us  to  provide  more  encouraging 
stories  about  IT's  positive 
impact  on  the  enterprise. 


Abbie  Lundberg,  Editor  in  Chief 

lundberg@cio.com 
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Lawson  Software.  All  rights  reserved. 
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The  larger  the  provider,  the  less  nimble  they  are  and  the  sloppier  the  implementation 

can  be.  SAP  has  a  long  list  of  failed  upgrades,  cost  overruns  and  dissatisfied 

■ 

customers.  But  they  are  big. 

It's  time  to  turn  to  Lawson  for  full  service  ERP  software  that  will  be  there  when  you 
need  it.  For  more  information  call  1-800-477-1357  or  visit  www.lawson.com/shift. 


Maybe  the  way  we  work 
isn’t  working. 

Enter  the  Intelligent  Document  Platform  from  Adobe. 

The  bridge  between  the  paper  and  digital  worlds. 

» 

Suddenly,  documents  become  smarter  and  infinitely 
more  useful.  Important  data  is  made  secure.  And 
information  intuitively  travels  where  it's  needed,  as 
it's  needed,  all  on  its  very  own.  It's  simplicity  at  work. 
The  Intelligent  Document  Platform.  Better  by  Adobe: 


See  how  others  are  crossing  the  paper  to  digital  bridge  at  adobe.com/idp. 


Adobe 


Adobe*  Intelligent  Document  Platform 
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See  your  global  infrastructure  in  a  new  way. 

Only  Riverbed  makes  your  remote  offices  feel  local. 

Most  applications  and  protocols  were  designed  to  run  locally.  Over  a  WAN,  they  grind  to  a  halt. 
That's  why  Riverbed  developed  a  solution  built  on  radically  new,  patent-pending  technology  that 
actually  delivers  LAN-like  performance  across  your  WAN.  Even  for  chatty  applications  that  can 
break  down  across  the  most  robust  networks. 

Riverbed's  proven  solution  allows  your  enterprise  to  consolidate  IT  infrastructure  at  the  data 
center,  optimize  your  bandwidth  usage,  and  still  deliver  applications  and  data  over  your  WAN  - 
at  speeds  that  make  remote  data  feel  local. 

We're  so  confident  that  Riverbed  can  improve  your  WAN  application 
performance,  we'll  even  let  you  try  it  for  30  days,  risk-free.  Call 
us  at  1 -87-RIVERBED  to  get  started  right  away,  or  visit 

www.riverbed.com/CIO  today. 
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E-Mail  Archiving 

I  enjoyed  “Message  Therapy”  (Jan.  15). 
However,  the  proposed  solution  creates 
new  exposure  for  a  company.  As  the  arti¬ 
cle  notes,  lawyers  love  e-mail.  And  today’s 
management  of  records  retention  does 
not  properly  address  e-mail  stored  on  a 
backup  medium;  messages  purged  by 
individuals  or  the  system  due  to  corporate 
retention  policy  are  often  not  removed 
from  backup  tape. 

This  would  be  the  same  issue  with 
any  incoming  or  outgoing  archive  system. 
E-mail  on  backup  tape  or  the  archive  sys¬ 
tem  would  be  open  to  discovery  in  legal 
situations.  Worse  yet,  an  automatic  archiv¬ 
ing  system  for  incoming  and  outgoing 
e-mail  could  be  keeping  messages  that 
the  recipient  decided  to  delete  soon  after 
receipt,  making  such  messages  available 
for  electronic  discovery  when  they  other¬ 
wise  would  not  be  available  in  such 
instances.  If  the  archive  system  could  sync 
with  the  individual’s  mailbox  for  deletion 
and  purging,  that  would  address  the  con¬ 
cerns  I  have  noted. 

STEVE DELAHUNTY 

Vice  President,  Technology  Services 
GlobalSource  LLC 
sdelahunty@gtobalsourcellc.net 

Build  Once,  Use  Many” 

Thank  you  for  both  stating  that 
informed  decision  making  (that  is,  IT  sim¬ 
plification)  handily  beats  ignorant  action 


(that  is,  blindly  cutting  IT  budgets),  as 
well  as  for  providing  many  perspectives 
and  analogies  to  illustrate  and  support 
this  concept  (“Prune  IT  Systems,  Not 
Budgets,”  Jan.  15).  Governments— similar 

to  other  large  bureaucracies  in  which 
the  financial  and  management 
aspects  are  too  far  removed  to 
understand  technology’s  frontline  value 
and  have  yet  to  adopt  the  architect’s  role  of 
master  planner— are  perfect  case  studies 
for  such  shortsighted  blunders. 

Your  presentation  is  timely  as  our  office 
begins  to  drive  Colorado  government 
toward  a  new  culture  of  operational  analy¬ 
sis  using  enterprise  architecture  (shared 
infrastructure)  and  performance  manage¬ 
ment  (customer-service  metrics).  When 
you  say,  “Don’t  cut  10  percent  of  the  IT 
budget;  cut  10  percent  of  the  IT  systems,”  I 
think  it  is  critical  to  also  make  clear  that 
this  refers  to  cutting  both  the  quantity  and 
the  size  of  IT  systems. 

Even  those  IT  systems  that  are  not 
entirely  cut  should  be  blown  apart  into  sep¬ 
arate,  basic  components  (interface,  busi¬ 
ness  rules,  data)  so  that  redundancy  at  this 
level  of  granularity  also  can  be  eliminated 
by  taking  advantage  of  common  or  shared 
services  (portal,  ID  management,  data 
stores,  payment  engine  and  so  on).  Decision 
makers  should  realize  that  architects’ 

“build  once,  use  many  times”  strategy 
offers  the  flexibility  of  reusing  both  IT  sys¬ 
tems  and  individual  system  components. 

DANIEL  SULLIVAN 

Enterprise  IT  Portfolio  Manager 
Governor’s  Office  of  Innovation 
and  Technology,  Colorado 
daniel.sullivan@state.co.us 

Dell  Clarifies 

In  "Innovation  Ships  Out"  (Jan.  15), 
Christopher  Koch  reports  that  Dell  does 
not  design  or  manufacture  its  own  note¬ 


books.  This  is  not  true.  While  we  do  work 
with  third-party  companies  in  some  areas 
of  design,  Dell  engineers  own  the  design 
process  of  its  systems.  Dell  does  not  man¬ 
ufacture  motherboards  or  system  cases. 

We  do,  however,  have  companies  pro¬ 
duce  these  components  based  on  our  speci¬ 
fications.  These  companies  are  suppliers  to 
Dell,  just  like  a  processor  or  a  hard-drive 
company.  Dell  builds  all  of  its  notebooks  at 
its  factory  in  Penang,  Malaysia.  For  U.S. 
customers,  orders  are  built  and  shipped  by 
Dell  from  Malaysia  to  one  of  three  Dell- 
{  owned  and  -operated  fulfillment  centers. 
It’s  wrong  to  say  that  Dell  never  touches  a 
customer  notebook  order. 

In  the  sidebar,  Koch  includes  Dell  in  a 

I 

list  of  companies  that  “outsource  most,  if 
not  all,  of  the  design  and  manufacturing 
of  some  of  their  products.”  Dell  designs  all 
of  its  products  and  manufactures  all  but 
printers  and  PDAs. 

At  Dell,  we  view  our  ability  to  manufac¬ 
ture  our  products  efficiently  as  a  competi- 
I  tive  differentiator. 

LIONEL  MENCHACA 

i  Dell  Corporate  PR 

lionel_menchaca@detl.com 

Executive  Editor  Christopher  Koch  replies: 

I  was  incorrect  to  say  that  Quanta  “drop- 
ships”  laptops  directly  to  Dell  customers. 
Dell  receives  and  handles  shipping  for 
those  computers  itself.  I  was  also  incorrect 
to  say  Dell  outsources  digital  camera  man¬ 
ufacturing.  Dell  does  not  sell  digital  cam¬ 
eras.  I  apologize  for  these  errors. 


What  Do  You  Think? 


Send  your  thoughts  and  feedback  to 
letters@cio.com,  Letters  may  be  edited  for 
length  or  clarity.  Fora  linkto  the  articles 
mentioned,  go  to  www.cio.com/040105. 
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PLEASE  NOTE: 

HACKERS  TRIED 
TO  ACCESS  OUR  ACCOUNTS 
126  TIMES  LAST  YEAR 
(THAT  WE  KNOW  OF) 


Even  if  everyone 
knew  about  the 
problem,  would 
anyone  know  the 
solution? 

As  every  aspect  of  business 
migrates  to  the  Web,  sensitive 
information  once  sheltered  is 
now  exposed.  Because  browser- 
based  applications  pass  through 
the  entire  security  perimeter. 

If  that  doesn't  wrinkle  your 
brow,  in  a  recent  study  70  percent 
of  companies  reported  security 
intrusions,  with  an  average  of 
136  annually. 

The  only  real  answer  is  a  solu¬ 
tion  that  knows  exactly  what 
your  application's  traffic  should 
look  like,  and  blocks  everything 
else.  A  comprehensive  solution 
that  gives  you  complete  control 
over  who  gets  access  from  where 
and  when,  that  can  actually 
identify  and  filter  application- 
level  cyber  attacks. 

It's  application  traffic  man¬ 
agement  taken  to  the  next  level. 
Something  that  could  only  have 
come  from  a  deep  understanding 
of  both  the  network  and  the 
application.  Which  is  why  only  F5 
can  offer  it.  For  details  on  this 
revolutionary  architecture,  includ¬ 
ing  our  Traff icShield™  Application 
Firewall  and  FirePass®  SSL  VPN, 
visit  www.f5.com/ciobank  or  call 
866-440-0184. 


fit 


WE  DIDN’T  BUILD  THIS 
I.T.  SYSTEM. 


ibm.com/ondemand 


Add  a  server  here.  Upgrade  a  storage  solution  there.  Throw  in  a 
database.  And  before  you  know  it,  the  IT  system  that  was  once  your 
pride  and  joy  has  become  an  albatross.  A  complex,  hard-to-manage 
albatross  that’s  holding  your  company  ransom.  Time  for  change. 

WE  JUST  BOUGHT  IT.  NO  WAY  WE’RE  REPLACING  IT.” 

We’re  with  you.  Another  huge  capital  investment  is  not  the  answer. 

Integration  is.  You  have  the  strategies  and  the  systems.  You  just  need 
to  get  your  business  priorities  and  your  technology  aligned.  Cue  IBM 
and  On  Demand  Business.  We’ll  help  you  get  more  from  what  you’ve 
got.  By  linking  departments,  connecting  processes  and  simplifying, 

end  to  end  “GREAT.  BUT  I  CAN’T  START  EVERYWHERE” 

You  don’t  need  to.  Integration  is  not  an  all-or-nothing  thing.  Small 
changes  can  reap  huge  rewards.  And  our  experience  and  expertise 
can  help  identify  them.  We  understand  the  procedures  that  make  your 
business  tick.  We  know  infrastructure.  We’re  not  fazed  by  complexity. 

We  see  through  it.  Identify  key  issues.  Zero  in  on  the  best  place  to  start 
for  immediate  returns.  Then  make  it  happen.  With  solutions  that  are 
platform  and  system  friendly,  but  more  importantly,  business-strategy 

friendly  too  “THAT  WOULD  WORK,  I  THINK” 

It  would.  We  help  thousands  of  companies  do  it  every  day.  Join 
them.  Create  the  manageable,  affordable,  dependable  infrastructure 
you  always  planned.  Discover  how  at  ibm.com/ondemand/operations 

JjJJ)  DEMAND  BUSINESS 


IBM,  the  IBM  logo  and  the  On  Demand  logo  are  registered  trademarks  or  trademarks  of  International  Business  Machines 
Corporation  in  the  United  States  and/or  other  countries.  Other  company,  product  and  service  names  may  be  trademarks  or 
service  marks  of  others.  ©2005  IBM  Corporation.  All  rights  reserved. 


what  will  SAS  software  mean  for  you? 


SAS  software  delivers  one  powerful  business  intelligence  and  analytics  platform  for  gaining  greater 
return  on  intelligence  —  in  less  time,  For  nearly  30  years,  SAS  has  been  helping  companies  gain  answers 
to  their  most  pressing  business  questions  and  address  their  most  challenging  issues... taking  them 
Beyond  Bl.  Find  out  why  94%  of  the  FORTUNE  Global  500  rely  on  SAS  to  increase  profits,  reduce  costs, 


www.sas.com/value 


The  Power  to  Know 
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E-Gov  Hits  a  Snag 


government  A  uniquely 
Washington,  D.C.,  phenomenon 
played  itself  out  this  winter:  Several 
reports  proclaiming  the  success  of  a 
government  reform  plan— specifi¬ 
cally  electronic  government— were 
released.  But  many  experts  in  the 
know  continue  to  question  the  suc¬ 
cess  of  the  reform  effort;  such  insid¬ 
ers  worry  that  when  it  comes  to  a 
truly  digital  government  that  could 
save  money  and  streamline  opera¬ 
tions,  there  exists  a  decided  lack  of 
direction  and  interest. 

Within  weeks,  four  unrelated 
reports  claimed  in  varying  degrees  the 
progress  that  the  federal  government 
has  made  in  creating  an  electronic 
government.  “The  American  Cus¬ 
tomer  Satisfaction  Index  E-Gov 
Report,”  conducted  by  ForeSee 
Results  for  the  University  of  Michigan, 


reported  in  December  that  Ameri¬ 
cans’  satisfaction  with  government 
websites  showed  a  “steady  increase” 
from  the  third  quarter  to  the  fourth 
quarter  of  2004.  Then,  the  Office  of 
Management  and  Budget  (OMB)  in 
the  White  House  declared  in  its 
report  “Expanding  E-Government” 
that  “...the  federal  government  is 
delivering  results  through  expansion 
and  adoption  of  electronic  govern¬ 
ment  principles....”  Up  next,  The  U.S. 
Government  Accountability  Office 
issued  a  report  concluding  that  fed¬ 
eral  agencies  had,  for  the  most  part, 
met  the  requirements  of  the  E-Gov 
Act  of  2002— such  as  creating  web¬ 
sites  for  federal  courts.  Finally, 

Input,  a  market  research  company, 
released  a  report  saying  that  spending 
on  e-government  (defined  as  “any 

Continued  on  Page  22 


Something  Wiki  This  Way  Comes 
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END  USER  DEVELOPMENT 

In  Hawaiian,  “wiki  wiki"  means 
“quick."  In  IT  speak,  a  wiki  is  a 
website  that  lets  anyone  quickly  add 
or  edit  content.  The  concept  began 
small,  as  a  grassroots  way  to  build 
online  knowledge  repositories 
(such  as  Wikipedia.org).  But  now 
startups  such  as  JotSpot  are  out  to 
harness  the  power  of  wikis  for 
businesses.  JotSpot’s  wiki-based 
software  lets  companies  create 
wikis  for  business  processes. 

Opsware,  a  data  center  automation 


software  vendor,  has  used  JotSpot 
to  create  in  a  few  hours  applications 
that  might  have  cost  $50,000  to 
$100,000  to  develop  in  Java. 
Although  JotSpot's  pricing  hadn’t 
been  finalized  at  press  time,  it’s 
expected  to  cost  around  $5  per  user 
per  month.  Opsware’s  technical 
sales  team  uses  one  JotSpot  wiki 
to  manage  information  such  as 
proposals  and  status  reports 
associated  with  pilot  projects  for 
prospective  customers.  “It’s  a  very 
rich  document  management 


system,”  says  Jason  Rosenthal, 
vice  president  of  client  services  at 
Opsware.  “It’s  so  quick  and  easy 
that  a  new  user  can  learn  to  use  it 
in  10  to  15  minutes.”  The  software 
also  reduced  the  time  it  took  the 
company  to  prepare  for  a  proof  of 
concept  from  five  days  to  three, 
Rosenthal  claims,  adding  that  wikis 
will  revolutionize  how  companies 
share  information  internally.  Says 
Rosenthal,  “it’s  easier  for  new  users 
to  do  what  it  used  to  take  a  webmas¬ 
ter  to  do.”  -Alice  Dragoon 


Time  or  Money? 
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E-Gov  Hits  Snag 


COMPENSATION 


In  a  poll  of  4,600 
people,  39%  said  they 
would  rather  have  more 
time  off  than  a  $5,000 
increase  in  annual  salary. 


SOURCE:  Salary.com 


Flight  Info  on  Autopilot 

wireless  communications  Until  late  last  year,  passengers 
flying  out  of  Fresno  Yosemite  International  airport  had  to  work  hard  to  get 
flight  information.  In  orderto  check  theirflight’s  status,  they  had  to  line  up 
at  the  counter  to  ask  already  hassled  airline  staff.  "The  situation  was  putting 
a  real  strain  on  the  staff  here  and  making  passengers  miserable,”  says  Patti 
Miller,  the  airport’s  air  service  and  marketing  manager. 

In  November,  the  Fresno 
airport  became  the  first  in  the 
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Welcome  to  Fresno  Yosemite  International  Airport: 
The  whit*  curb  Is  for  loading  and  unloacfing  only. 


Automatic  updates:  In  Fresno, 
passengers  can  check  real-time  flight 
information  delivered  on  kiosks. 


country  to  use  a  Web-based 
wireless  system  to  display  real¬ 
time  flight  information  from 
radars— rather  than  airline 
staff— at  electronic  kiosks  in 
the  airport.  And  in  February, 
the  radar  flight  information  went 
live  on  the  airport’s  website 
( www.flyfresno.org ),  allowing 
passengers  to  check  a  flight’s 
status  from  home. 

At  most  large  metropolitan 

airports,  dominant  carriers  usually  run  the  flight  information  display  sys¬ 
tems,  and  airline  staff  provide  regular  updates.  But  as  major  airlines  face 
increasing  economic  pressure,  many  are  falling  behind  on  the  task.  And  at 
the  country’s  smaller  regional  airports,  the  role  of  information  provider  is 
falling  to  the  airport  itself.  Building  data  links  to  carriers  to  provide  accurate 
flight  information  is  often  too  expensive,  however.  The  result  is  that  informa¬ 
tion  is  either  delayed  or  never  updated. 

After  looking  into  systems  that  cost  as  much  as  $500,000,  Fresno  chose  a 
system  from  Megadata  called  Passur  Flightlink,  which  delivers  flight  informa¬ 
tion  via  the  Web.  The  airport  invested  $139,000  for  installation  and  hardware, 
and  pays  a  $15,000  yearly  subscription.  Megadata,  which  hosts  the  software, 
operates  its  own  network  of  radar  around  the  country  that  can  independ¬ 
ently  track  flights.  Staff  at  Fresno  airport  can  log  on  and  update  the  system 
whenever  they  want,  but  the  system  can  run  on  its  own.  Says  Miller:  “That’s 
important  when  airport  and  airline  staff  is  limited.”  -Susannah  Patton 


Continued  from  Page  21 
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information  system  that  performs  a  mission- 
oriented  function”)  would  increase  from  $4  billion 
in  FY04  to  nearly  $6  billion  in  FY09. 

Dig  deeper  into  the  ongoing  dialogue,  and  a 
different  picture  begins  to  emerge.  While  e-gov¬ 
ernment  initially  made  some  progress  in  2001 
and  2002,  it  has  yet  to  meet  the  expectations  of 
fundamentally  improving  government  operations. 
For  sure,  Americans  can  file  taxes,  reserve  a 
camping  site  and  buy  Treasury  bills  online. 

And  some  cross-government  systems  have  been 
developed  to  consolidate  government  services 
in  numerous  agencies,  such  as  filing  electronic 
grant  proposals.  But  most  e-gov  experts  agree: 
E-gov  has  hit  a  lull. 

What’s  happened?  It’s  always  easy  to  point 
to  a  shortage  of  money.  But  for  e-government,  a 
lack  of  money  is  an  understatement.  In  his  first 
term,  President  Bush  set  a  benchmark  of  $100 
million  over  three  years  to  fund  e-government 
projects.  The  E-Gov  Act  of  2002,  which  set  out 
basic  requirements  for  e-government,  called 
for  $345  million  over  the  next  five  years.  Yet 
Congress  delivered  only  $5  million  in  FY03, 

$3  million  in  FY04  and  just  $5  million  in  FY05. 

But  others  say  the  e-government  malaise  is  the 
result  of  government  itself.  The  next  generation 
of  e-gov  projects,  which  mostly  involve  sharing 
information  across  agencies,  could  transform 
government  services.  But  such  projects  require 
data  integration  across  agencies,  a  prospect 
that’s  not  easy,  warns  Mark  Forman,  the  former 
top  federal  e-government  and  IT  executive  at  the 
OMB  and  now  executive  vice  president  of  world¬ 
wide  services  for  Cassatt,  an  operations  automa¬ 
tion  products  company.  Agencies  tenaciously 
guard  the  use  of  their  information,  and  cajoling 
them  to  share  may  take  years.  Add  to  that  pri¬ 
vacy  issues,  and  you  have  major  roadblocks  to 
overcome.  Says 


Forman:  “These  . 
are  tough  cultural 
issues,  and  it’s  what 
is  holding  up  e-gov.” 
- Allan  Holmes 


Get  More  Info 


For  more  on  the  reports 
mentioned  in  this  article, 
visit  www.cio. com/040105. 
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THE  NEW  CURRENCY 

AT  THE  LUNCH  LINE 


biometrics  For  many 
students  in  the  Penn  Cambria 
public  school  district,  misplaced 
milk  money  is  a  problem  of  the 
past.  Since  1999,  the  school  dis¬ 
trict,  located  near  Pittsburgh, 
has  been  using  biometric  fin¬ 
gerprint  scanning  technology 
from  Food  Service  Solutions  to 
streamline  cafeteria  service  for 
the  district’s  1,800  students. 
Brenda  Bucynski  of  Penn  Cam¬ 
bria’s  food  services  office  says 
the  fingerprint  scanning  units 
located  in  school  cafeterias 
throughout  the  district  expe¬ 
dite  lunch  lines  and  grant 
anonymity  to  students  who  are 
enrolled  in  free  or  reduced-cost 
lunch  programs.  For  parents, 
the  convenience,  of  fingerprint 


scanning  is  twofold:  They  can 
prepay  for  lunches  and  see  what 
their  kids  are  buying;  transac¬ 
tion  histories  let  parents  know 
whether  their  kids  are  buying 
sloppy  joes  or  Scooter  Pies. 

Once  students  have  debit 
accounts  set  up,  system  regis¬ 
tration  takes  about  one  minute 
per  student.  After  a  fingerprint 
is  scanned  by  a  small  unit,  soft¬ 
ware  creates  a  template  from  a 
grid  of  27  intersection  points 
based  on  the  swirls  and  arcs  of 
a  student’s  fingerprint.  Food 
Service  Solutions  says  scanned 
fingerprints  cannot  be  used 
by  law  enforcement  for  identifi¬ 
cation  purposes  because  the 
fingerprint  itself  is  not  stored 
on  the.  system.  The  fingerprint 


That  will  be  one  index  finger,  please:  Thousands  of  public  school  stu¬ 
dents  pay  for  lunch  by  using  their  fingerprints  ratherthan  reaching  fortheir  wallets. 


map  that  is  created  at  registra¬ 
tion  is  stored  as  a  mathematical 
algorithm,  and  the  fingerprint 
image  is  discarded  after  each 
use;  only  the  template  with  the 
corresponding  27  intersection 
points  remains. 

The  technology  is  currently 
used  in  45  public  school  districts. 
Two  college  campuses  also  use 
fingerprint  scanning  to  replace 
the  traditional  JD  cards.  Bucyn¬ 


ski  says  Penn  Cambria  decided 
to  use  biometrics  “to  set  parents’ 
minds  at  ease.”  In  the  past,  high 
schoolers  would  use  lunch 
money  to  buy  other  things,  such 
as  cigarettes.  For  elementary 
schools,  biometrics  has  enabled 
teachers  to  spend  less  time  col¬ 
lecting  money  and  handing  out 
lunch  tickets,  a  process  that 
took  as  much  as  a  half-hour 
each  day. . -Margaret  Lacker  _j_ 


Positions  Wanted:  Combustible 
Clergy;  Gibberish  Therapist 


careers  Looking  for  a  fire-breathing  minister  to  officiate  your  wedding?  How  about  a  therapist  who 
can  teach  you  the  art  of  improvisational  gibberish?  If  you  can’t  find  either  one  in  the  Yellow  Pages  try 
Tribe.net,  a  San  Francisco-based  website  where  some  500,000  unique  visitors  go  each  month  to  find  a  job 
or  roommate,  make  friends,  sell  stuff  or  solicit  bizarre  services. 

The  20-person  operation  launched  in  the  fall  of  2003,  and  shares  similarities  with  Craigslist,  a  widely 
successful  Web  classifieds  and  community  site  that  also  got  its  start  in  the  Bay  Area.  Visitors  who  are 
familiar  with  Craigs! ist’s  no  frills  design  will  recognize  Tribe. net’s  similar  bare-bones  user  interface  of 
mostly  text  links.  Another  similarity  is  that  Tribe.net,  like  Craigslist,  does  not  rely  on  advertising-related 
revenue.  What’s  different  from  Craigslist,  though,  is  that  Tribe.net  users  can  attach  a  profile  to  their  posts, 
letting  visitors  know  a  little  something  about  them.  According  to  Wade  lagrone,  vice  president  of  market¬ 
ing  at  Tribe.net,  the  profiles  help  build  trust  among  users  and  foster  a  stronger  sense  of  community  by 
reducing  anonymity.  Posting  a  profile  requires  free  registration,  and  Tribe.net  claims  to  have  about  200,000 
members  who  have  formed  some  25,000  “tribes,"  or  discussion  groups.  Tribe.net  is  available  in  40  cities 
in  the  United  States,  although  it  is  most  popular  on  the  West  Coast,  Lagrone  says.  Venture-backed  tribe.net 
eventually  plans  to  make  money  by  charging  commercial  businesses  for  job  listings,  which  number  in  the 
thousands).  But  the  “outrageous”  job  postings,  which  launched  in  January,  will  remain  free.  That  may  be  a 
good  strategy  considering  some  of  the  offerings.  Would  you  pay  a  guy  who  specializes  “generally  in  bringing 
property  values  down”  $20  an  hour  plus  expenses  to  bug  your  uptight  neighbors?  -Jon  Surmacz 
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Choose 
and  receive 
any  of  these  3  valuable 


Choose  and  receive  any  of  these  3  APC 
white  papers  within  the  next  90  days  for  FREE! 

□  White  Paper  #40  "Cooling  Audit  for  Identifying  Potential  Cooling  Problems  in  Data  Centers" 

□  White  Paper  #42  "Ten  Steps  to  Solving  Cooling  Problems  Caused  by  High  Density  Server  Deployment' 

□  White  Paper  #1 17  "Network-Critical  Physical  Infrastructure:  Optimizing  Business  Value" 

□  YES!  Please  send  me  my  FREE  white  papers.  □  NO  ,  I'm  not  interested  at  this  time,  but  please  add  me  to  your  mailing  list. 

Name:  Title: 


APC  white  papers  within 

Company: 

the  next  90  days  for  FREE! 

Address: 

Address  2: 

City/Town: 

State: 

Zip:  Country: 

Key  Code  y888y 

Phone: 

Fax: 

E-mail: 

http://promo.apc.com 


Yes!  Send  me  more  information  via  e-mail  and  sign  me  up  for  APC  PowerNews  e-mail  newsletter.  Key  Code  y888y 


(888)  289-APCC  x3372  •  FAX:  (401)  788-2797 


Legendary  Reliability' 


What  type  of  availability  solution  do  you  need? 

□  UPS:  0-1 6kVA  (Single-phase)  □  UPS:  10-80kVA  (3-phase  AC)  □  UPS:  80+ kVA  (3-phase  AC)  □  DC  Power 

□  Network  Enclosures  and  Racks  □  Precision  Air  Conditioning  □  Monitoring  and  Management  □  Cables/Wires 

□  Mobile  Protection  □  Surge  Protection  □  UPS  Upgrade  □  Don't  know 

Purchase  timeframe?  □  <  1  Month  □  1-3  Months  □  3-12  Months  □  1  Yr.  Plus  □  Don't  know 
You  are  (check  1):  □  Home/Home  Office  □  Business  (<1000  employees)  □  Large  Corp.  (>1000  employees) 

□  Gov't.,  Education,  Public  Org.  □  APC  Sellers  &  Partners 
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BUSINESS  REPLY  MAIL 

FIRST-CLASS  MAIL  PERMIT  NO.  36  WEST  KINGSTON,  Rl 
POSTAGE  WILL  BE  PAID  BY  ADDRESSEE 


AMERICAN  POWER  CONVERSION 

ATTENTION  CRC:  y888y 
DEPARTMENT:  B 
132  FAIRGROUNDS  ROAD 
PO  BOX  278 

WEST  KINGSTON  Rl  02892-9920 
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How  to 
Contact  APC 

Call:  (888)  289-APCC 

use  the  extension  on  the 
reverse  side 

Fax:(401)  788-2797 

Visit:  http://promo.apc.com 
use  the  key  code  on  the  reverse 
side 


Legendary  Reliability' 


What  is 
data  centei 
on  demand. 


Now  you  can  quickly  deploy  a 
standard-  or  high-density  site  of  any  size 
with  scalable,  top-tier  availability. 


Part 

Number 

Usable 

IT  Racks 

Average 
kW  per  Rack 

Price 
to  buy 

Price  to  lease 
(36  installments) 

ISXCR1SY16K16P5 

1 

up  to  5kW 

$1 4,999* 

s499” 

ISXT240MD6R 

6 

up  to  5kW 

$1 49,999' 

s4,999~ 

ISXT240MD11R 

11 

up  to  5kW 

$249,999* 

$7,999” 

ISXT280MD40R 

40 

up  to  5kW 

s699,999* 

s2 1,999" 

ISXT2800MD100R 

100 

up  to  5kW 

$1 ,649,999* 

s50,999‘* 

High  Density  Configuration  (shown  above) 

ISXT280HD8R 

8 

up  to  lOkW 

s399,999* 

S1 2,999” 

High  density  upgrades  start  at  S1 0,999 

On-site  power  generation  options  start  at  s29,999 

All  multi-rack  configurations  feature: 

V  N+ I  power  and  cooling 

V  Secure,  self-contained  environment 

V  Peak  capacity  of  20kW  per  rack 
J  Enhanced  service  package 

J  Integrated  management  software 


InfraStruXure  Manager 


Order  your  solution  today.  Call  888-289-APCC  x3372. 


Visit  today  and  receive  FREE  APC  White  Papers 

Visit  us  online  and  download  APC  White  Papers. 

Don't  see  the  configuration  you  need? 

Try  APC's  online  InfraStruXure”  BuildOut  Tool  today  and  build  your  own  solution. 

Go  to  httpy/promo.apcj:om  and  enter  key  code  y888y  Call  888-289-APCC  x3372 


Pbyiicil  Inlrax/ucltun 

Optimums 
SutiRMa  Value 


Infrastructure- 

DATA  CENTERS  ON  DEMAND 

Highly  available  and  manageable, 
quick-to-install,  scalable  architecture 
that  easily  supports  both  standard- 
and  high-density  applications. 

-  Up  to  20 kW  a  rack  for  any 
blade  server  application 

-  Unlimited  racks 

-  Ships  in  5  days*** 

-  Installs  in  1  day*** 

-  Optional  on-site  power 
generation 

-  Raised  floor  not  required 

-  Vendor  neutral  guaranteed 
compatibility 


Ten  Stsp>  to  Solving 
Cooling  Problem* 
ChumP  by  High  ~ 
Server  Deployment 


InfraStruXure "  can  be  purchased  as  a 
modular,  conventional  or  mobile  system 


Legendary  Reliability’ 


Chamber  Doors 

Access  to  hot  aisle, 
locks  for  security 


BEST  OF  INTEROP 


<«/ 

BLADE 

READY' 


APC  solutions  that  carry 
the  "Blade-Ready''  Logo 
are  designed  to  handle  the 
demanding  network-critical 
physical  infrastructure 
requirements  of  high-density 
blade  server  applications. 


InfraStruXure  '1  BuildOut  Tool 


*  Prices  do  not  include  IT  equipment  and  are  subject  to  change.  **  Indicative  rates  are  subject  to  market  conditions.  Install  and  delivery  times  may  vary. 
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infrared  scanning  For  a  few  months  last  year,  the 
Ohio  State  Highway  Patrol  had  more  eyes  on  the  highways.  The 
additional  “eyes”  were  actually  part  of  a  new  infrared  scanning 
system  that  examined  the  license  plates  of  vehicles  traveling  on 
the  241-mile  long  Ohio  Turnpike. 

The  premise  behind  the  Automatic  Plate  Recognition  (APR) 
system  is  to  use  technology  to  nab  stolen  cars.  The  system  scans 
license  plates  in  two  ways:  as  vehicles  pay  tolls  or  as  patrol  cars 
equipped  with  roving  scanners  drive  along  the  highway.  In  the 
pilot  that  took  place  in  Ohio,  scanned  license  plate  numbers 
were  matched  with  plate  numbers  logged  into  the  state’s  crime 
database.  Based  on  the  National  Crime  Information  Center’s 
(NCIS)  database,  Ohio’s  database  includes  plates  for  stolen  vehi¬ 
cles  and  for  fugitives  wanted  across  the  country. 

During  the  pilot  conducted  from  August  2004  to  November 
2004,  the  Ohio  State  Highway  Patrol  apprehended  23  criminal 
suspects  and  recovered  24  stolen  vehicles  valued  at  $221,000— 
a  50  percent  spike  in  auto  theft  recoveries  on  the  highway  com¬ 
pared  to  the  same  time  frame  the  year  before. 

The  system  is  not  without  its  shortcomings.  Since  it  simply 
scans  for  characters  and  not  patterns,  it  cannot  recognize  what 
state  a  plate  is  from  or  any  other  distinguishing  vehicle  charac¬ 
teristics.  Thus,  a  trooper  who  receives  an  alert  of  a  possible  stolen 
vehicle  while  on  patrol  has  many  possible  plate  permutations 
and  vehicle  types  to  sort  through  while  searching  for  the  suspect. 

Another  issue:  “false  positives.”  If  a  Florida  plate  is  wanted, 
yet  a  plate  from  Pennsylvania  has  the  same  characters,  a  trooper 
could  stop  the  wrong  person.  (A  trooper  first  looks  for  charac¬ 
ters  that  match,  and  then  checks  the  NCIS  database  to  confirm 
whether  or  not  the  suspect  in  question  has  been  pulled  over.) 
“That’s  a  problem,”  says  Jeff  Gamso  of  the  Ohio  American  Civil 
Liberties  Union.  Gamso  also  noted  that  NCIS  information  is  not 
always  100  percent  accurate.  “If  I’m  pulled  over  due  to  faulty 
NCIS  information,  I’m  not  likely  to  be  let  go  in  five  minutes.” 

According  to  Sgt.  Joe  Luebbers,  the  highway  patrol  is  aware  of 
such  issues  and  has  put  safeguards  in  place.  “Confirmation  is  a 
key  part  of  our  process.  When  we  stop  someone,  we  contact  the 
agency  that  put  the  plate  into  the  database  to  verify  that  this  is 
the  car  or  the  person  they  want,”  he  says.  Even  so,  Gamso  worries 
about  the  “incremental  invasion  of  privacy.”  If  used  correctly, 
APR  simply  extends  what  the  highway  patrol  already  does.  If 
the  information  is  faulty  or  abused,  however,  it  represents  more 

than  an  inconvenience. 

i  i 

With  a  successful  pilot  completed,  the  highway  patrol  is 
awaiting  funding  from  the  Ohio  Controlling  Board  to  roll  out 
APR  statewide.  -Jeff  Vance 
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The  Shipping  News 

on  the  move  Logistics  providers  UPS  and  DHL 
have  witnessed  changes  among  their  CIO  ranks  lately. 
Ron  Kifer  was  promoted  to  CIO  for  DHL  Express 
Europe  and  is  now  based  in  Brussels.  Kifer  most 
recently  served  as  vice  president  of  program  and 
solutions  management  for  DHL  Americas,  where, 
among  other  responsibilities,  he  built  the  company’s 
program  management  office  and  led  software 
development  within  the  Americas. 

At  UPS,  David  Barnes  succeeded  Kenneth  Lacy 
as  senior  vice  president  and  CIO  on  Jan.  3,  2005.  So 
what  can  Brown  do  for  Lacy  now?  Deliverthe  guy  a 
nice  retirement  package  after  his  37  years  of  service. 

Notably,  Lacy  and  Barnes  have 
similar  backgrounds  with  UPS: 
They  both  started  out  in  low-level 
positions  (Lacy  as  a  clerk  and 
Barnes  as  a  package  loader)  and 
worked  their  respective  ways  up 
the  corporate  ladder  while 
pursuing  college  degrees.  Lacy 
must  have  seen  a  bit  of  himself  in 
Barnes  when  he  named  him  as 
his  successor.  Lacy,  56,  joined  the 
company  at  the  ripe  old  age  of  18 
as  a  clerk  and  never  strayed. 
Barnes,  too,  is  a  lifer  (at  least 
thus  far).  At  48,  he’s  already 
clocked  27  years  of  service. 

The  IT  department  at  Freddie 
Mac  has  also  seen  its  share  of 
changes.  William  Ledman,  56, 
retired  as  senior  vice  president  of 
special  projects  technology  on 
April  1,  2005,  four  months  after 
Joseph  Smialowski  was  hired  as 
executive  vice  president  of  tech¬ 
nology  and  operations.  In  Janu¬ 
ary,  Smialowski  appointed  James 
Witkins,  54,  to  replace  Ledman. 

At  American  International 

Group  (AIG),  CIO  Mark  Popolano  has  received  a  pair 
of  accolades  recently.  In  December,  consultancy 
Bearing  Point  and  Forbes  magazine  honored  him 
with  a  Compass  award  for  championing  a  global 
voice  and  data  network  infrastructure.  In  January, 
Popolano  was  elected  to  succeed  Lawrence  English 
as  AIG’s  senior  vice  president  of  administration  while 
continuingto  serve  as  CIO. 

-Meridith  Levinson 


David  Barnes 

senior  vice  president 
and  CIO  at  UPS 


Mark  Popolano 

CIO  American 
International  Group 
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ILLUSTRATION  BY  ROB  PORAZ INSKI/GETTY  IMAGES 


OR  YOUR  MONEY  RACK 


Imagine  your  applications  -  both  legacy  and 
new  -  performing  together  as  an  ensemble. 

That  vision  can  become  a  reality  surprisingly 
quickly  with  Ensemble™  -  the  universal  integra¬ 
tion  platform  with  all  the  functionality  needed  to 
complete  any  type  of  integration  project  on  time 
and  on  budget. 

Much  more  than  a  messaging  engine, 

Ensemble  is  a  fusion  of  architecturally- consistent 
technologies  for  integration,  development,  deploy¬ 
ment  and  management  of  composite  applications 
that  preserve  and  extend  your  legacy  systems. 


Ensemble  is  breakthrough  software  from 
InterSystems,  a  global  company  with  over  25 
years  of  experience  deploying  and  supporting  high 
performance  data  management  products  in  more 
than  100,000  systems,  in  88  countries. 

We’re  so  confident  that  Ensemble  is  dramatically 
faster  and  easier  to  use  than  any  other  integration 
technology,  we  offer  this  money-back  guarantee: 

For  up  to  one  year  after  your  purchase,  if  you  are 
unhappy  for  any  reason  we  will  refund  100%  of  your 
license  fee. 

Rapid  integration  and  development.  Guaranteed. 


InterSystems 

E  ENSEMBLE 

Integrate  Applications  Faster 


Request  a  free  proof-of-concept  project  at  www.InterSystems.com/ rapid 
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Susan  Cramm  executive  coach 


Show  Them  How 


Even  perfect  execution  won’t  lead  to  perfect  IT.  You  must  encourage  business  users 
to  develop  some  IT  smarts  of  their  own. 


y 


.!*  : 


ou  have  probably  noticed  the  recent  research  and 
magazine  articles  about  “the  agile  IT  organiza¬ 
tion.”  Agile  is  a  great  word  for  IT  because  it 
speaks  to  the  core  IT  issues  of  “too  little,  too  late, 
for  too  much.”  To  be  agile  is  to  have  the  ability  to  move  quickly, 
with  suppleness,  skill  and  control.  It’s  a  noble  ambition  for 
CIOs,  but  it’s  unachievable  as  long  as  IT’s  role  is  unchanged. 

The  research  on  agile  IT  organizations  boils  down  to  a  rec¬ 
ommendation  that  IT  be  transformed  to  operate  like  a  busi¬ 
ness,  much  like  an  external  service  provider.  This  advice 
implicitly  assumes  that  if  IT’s  execution  is  perfected,  then  the 
outcome  will  be  agility,  and  the  core  complaints  of  your  business 
partners  will  be  addressed. 

But  let’s  face  facts:  Nobody  really  likes  external  service 
providers,  and  even  the  most  agile  IT  organization— featuring 
perfect  governance,  resource  management,  processes,  infra¬ 
structure,  cost  transparency  and  organizational  structure— 
probably  will  not  be  enough  to  satisfy  the  business’s  expectations 
on  time,  quality  and  cost. 

The  role  of  IT  has  to  change.  Your  business  partners  will  be 
satisfied  only  when  they  directly  control  IT  service  delivery 
and,  therefore,  feel  accountable  for  the  results.  Over  time,  IT  has 
assumed  “surrogate  user”  roles  that  the  business  has  been 
unable  or  unwilling  to  assume.  The  business  partners  of  tomor¬ 
row  (currently  in  their  late  20s  and  early  30s)  will  not  take 
such  a  passive  role  with  IT. 

CIOs  can  increase  IT  agility  by  getting  out  of  the  way.  They 
should  strive  to  enable  their  business  partners’  ability  to  satisfy 
their  day-to-day  IT  needs  on  their  own,  without  having  to  wait  in 
lengthy  governance  lines  for  project  approval,  funding  and  staffing. 
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ILLUSTRATION  BY  BELLE  MELLOR 


ADVERTISING  SUPPLEMENT 


intel.  Sybase 
X.  cingular 


How  Existing 
Technology  Can 


Data  Mobility  a 
Reality — Today  I 


Make  Enterprise 


The  Information  Edge 

Ifi  ]  e  all  recognize  the  tangible  business  value  of  information.  Companies  worldwide  have 
f J  invested  millions  of  dollars  in  technologies  that  collect,  analyze  and  secure  corporate 
data,  and  an  untold  wealth  of  information  resides  within  enterprise  walls. 

But  it's  not  enough. 


Custom  Publishing 


It's  not  enough  to  have  mission-critical 
enterprise  data  stored  in  a  centralized  sys¬ 
tem  at  corporate  headquarters  when  the 
employees  who  need  it  most  are  in  the  field 
interacting  with  customers.  It’s  not  enough 
to  build  a  data  warehouse  unless  that  data 
can  be  accessed  where  it's  needed — at  a 
hospital  bedside,  a  retail  aisle  or  a  distribu¬ 
tion  center.  It’s  not  enough  to  use  business 
intelligence  tools  to  analyze  information  in 
corporate  headquarters  while  the  most 
important  decisions  are  made  by  increas¬ 
ingly  mobile  frontline  employees  who  need 
to  access  the  data  anytime,  anywhere.  And 


it’s  not  enough  to  share  information 
through  the  corporate  intranet  and  email 
from  your  desktop,  while  your  competitor's 
workforce  is  doing  it  in  the  field. 

To  truly  maximize  information  assets, 
business  leaders  must  deliver  corporate 
information  to  employees  at  the  farthest 
edge  of  a  company — a  factory  floor,  a  distri¬ 
bution  warehouse,  a  customer  site,  in  a 
major  metro  area  or  in  small-town  USA. 

“The  ability  to  use  data  at  the  right  time 
and  place  can  have  a  dramatic  effect  on  a 
company’s  ability  to  make  informed,  agile 
decisions,”  says  Marty  Beard,  senior  vice 


ADVERTISING  SUPPLEMENT 


CASE  STUDY 


A  New  Path  for  BNSF  Railway  Company 


ven  the  most  venerable  company  knows  that  ongoing  transformation  is 
the  key  to  business  success.  For  BNSF  Railway  Company,  a  155-year-old 
company  with  $  11  billion  in  revenue,  mobile  technology  is  a  key  example  of 
its  continual  business  transformation. 

BNSF  needed  a  way  to  give  its  6,000  field  workers  access  to  important 
information  on  the  job.  The  railway’s  track  maintenance  workers,  for  example, 
spent  hours  each  day  desk-bound,  gathering  paper  and  data  from  different 
sources  before  they  could  tackle  their  real  work — maintaining  the  compa¬ 
ny’s  41 ,000  miles  of  track  stretched  across  28  states  and  two  Canadian 
provinces.  Once  that  work  was  done,  they  faced  more  paperwork,  as  they 
wrote  up  data  that  then  had  to  be  keyed  into  the  corporate  systems.  Bottom 
line:  These  field  employees  needed  a  way  to  quickly  access  work  orders  and 
information,  generate  reports  and  connect  with  central  operations,  as  well  as 
easily  and  reliably  capture  data  in  the  field  and  optimize  scheduling. 

A  team  put  together  by  Jeff  Campbell,  Vice  President,  Technology 
Services  and  CIO  at  BNSF,  created  a  solution  using  complete  mobilized 
solutions  based  on  Intel®  Centrino™  mobile  technology-based  notebooks 
to  access  the  Cisco-powered  802.11  b  hotspots  in  key  facilities,  while  rely¬ 
ing  on  Cingular’s  nationwide  wireless  data  network  to  access  critical  infor¬ 
mation  in  the  field.  Software  technologies  from  Sybase  bring  the  solution 
together  by  consolidating  the  necessary  mission-critical  data  from  corpo¬ 
rate  systems,  and  by  providing  the  mobile  data  management  and  synchro¬ 
nization  technology  to  bring  the  information  from  the  data  center  to  the 
mobile  device  and  back. 

As  a  result,  workers  now  stay  in  touch  with  business  data  and  applica¬ 
tions  all  day.  Moreover,  data  is  entered  as  work  is  done  and  validated  at  the 
point  of  the  labor,  greatly  increasing  data  accuracy  and  availability. 

“Mobility  will  be  the  key  driver  transforming  the  way  we  do  all  applica¬ 
tions  over  the  next  five  years,”  says  Campbell.  “The  engineering  workforce 
can  now  react  better,  interact  more  efficiently  with  our  dispatchers  and  be 
more  efficient  with  their  track  time,  so  our  train  flows  are  smoother  than 
ever  before.  There  are  just  tremendous  advantages  for  our  company." 


lenges,  and  reducing  deployment  risk. 

•  Companies  in  a  variety  of  industries 
and  sizes  are  adopting  mobile  and  wireless 
software  solutions  to  gain  and  retain  their 
competitive  edge. 

According  to  Aberdeen  Group,  field 
forces  enabled  by  mobile  technology  expe¬ 
rience  a  productivity  boost  of  100  percent 
after  only  two  years'  experience  with  wire¬ 
less.  Further,  according  to  recent  research 
performed  jointly  by  Cingular  and 
Accenture,  a  majority  of  businesses  that 
deployed  real-time  wireless  solutions  did  so 
to  boost  productivity  (64  percent  of  the 
Cingular/ Accenture  survey  respondents) 
and  realize  operational  cost  reductions  (52 
percent  of  the  respondents). 

That’s  good  news  for  companies  look¬ 
ing  to  gain  or  retain  their  competitive 
edge.  Mobility  gives  businesses  immedia¬ 
cy — the  ability  to  get  information  anytime, 
anywhere.  “Today  more  than  ever,  time  is 
money,  and  enterprises  are  working  hard 
to  accelerate  business  processes,  remove 
inefficiencies  and  accelerate  decisions,” 
says  Jeff  Bradley,  Vice  President  of 
Business  Data  Services  at  Cingular. 


“Today  more  than  ever,  time _ 

I  is  money,  and  enterprises  are 

|  working  hard  to  accelerate  business 

processes,  remove  inefficiencies 
and  accelerate  decisions." 


president  of  corporate  development  and 
marketing  at  Sybase.  “The  challenge  is  how 
to  make  the  most  of  the  assets  that  compa¬ 
nies  already  have  in  place  in  order  to  give 
employees  the  ability  to  securely  access 
information  anytime,  anywhere.” 

Consider  these  facts  about  mobile  sales  . 
force  and  field  service  enablement: 

•  ROI  is  tangible  and  measurable — 
productivity  and  efficiency  gains,  faster  and 
more  informed  decisions,  improved  accu¬ 
racy  and  reduced  paperwork. 

•  Technology  has  reached  a  level  of 
maturity — overcoming  integration  chal- 


“Companies  began  to  experience  the  bene¬ 
fits  of  immediacy  by  implementing  wire¬ 
less  email,  and  by  now  virtually  every 
company  has  deployed  a  wireless  email 
solution  to  mobile  professionals.  From 
health  care  delivery,  to  consumer  goods 
manufacturing,  to  high-tech  field  services, 
business  executives  are  witnessing  a  pro¬ 
ductivity  boost  fueled  by  real-time  wire¬ 
less  data.” 

The  need  for  always-available  comput¬ 
ing,  the  ability  to  access  information  any¬ 
time,  anywhere,  regardless  if  a  network 
connection  is  available  or  not,  is  particular- 
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ly  relevant  in  light  of  increasing  market 
pressures  to  better  serve  customers  at  the 
edges  of  corporate  value  chains.  The  front 
line,  where  customers  and  partners  actually 
interact  with  a  business,  is  the  place  most 
likely  to  have  limited  access  to  business 
knowledge — and  that’s  where  it  will  bring 
the  most  benefit.  Using  mobile  solutions  to 
give  field  personnel  access  to  pertinent 
data  allows  workers  to  cross-sell  and  upsell 
more  effectively,  whether  during  a  service 
call  or  at  the  point  of  sale. 

At  the  same  time,  it's  always  a  safe  bet 
that  competitors  are  also  working  on  mobile 
strategies  to  allow  their  workers  to  do  busi¬ 
ness  faster,  cheaper  and  more  effectively. 
“Effective  mobilized  solution  strategies  are 
based  on  the  move  toward  a  Services 
Oriented  Enterprise,”  says  Chris  Thomas, 
Chief  Strategist  at  Intel.  "Many  companies 
today  are  now  effectively  integrating  mobile 
device  platforms  with  mobilized  applications 
utilizing  wireless  connectivity  to  deliver 
information  at  the  edge  of  their  enterprise.” 

Solutions  Are  Here  Today 

In  a  confluence  of  need  and  ability,  the 
technology  that  underpins  an  enterprise 
mobile  strategy  has  attained  the  maturity 
necessary  to  support  vital  business  goals. 
Consider: 

Improved  Products — New  form  fac¬ 
tors,  longer  battery  life  and  the  ability  to 
run  on  multiple  operating  systems  means 
that  mobilized  devices  based  on  Intel® 
Centrino™  mobile  technology  provide 
mobile  workers  with  ever-more  productivi¬ 
ty.  Middleware  solutions  such  as  Sybase’s 
iAnywhere  mobile  software  technologies 
allow  developers  to  write  once  and  deploy 
to  any  device. 

Reliable  Networks — Wide-area  wire¬ 
less  networks  such  as  Cingular’s  nationwide 
wireless  data  network  with  EDGE  technol¬ 
ogy  can  now  provide  high-speed,  reliable 
and  global  connectivity.  Enterprises  can 
now  deploy  consistent,  enterprise-grade 
solutions  to  access  information  wirelessly 
for  increased  productivity. 

Open  Standards — Today’s  leading 
mobile  software  and  hardware  technolo- 


ingular  Wireless  is  the  nation’s  largest  wireless  carrier,  serving  95 
percent  of  the  Fortune  100  and  more  than  80  percent  of  the 
Fortune  500.  Cingular  offers  businesses: 

•  The  largest  digital  voice  and  data  network  in  America 

•  The  widest  global  roaming  footprint  of  any  US-based  wireless 
provider 

•  The  fastest  national  wireless  data  network  with  EDGE  technology 
Cingular  provides: 

•  End-to-end  services  to  drive  rev-  £  |  p|  q  U  J  3  f  * 

enue,  reduce  cost  and  enhance  ^  wireless 

customer  satisfaction 

•  Wide  selection  of  business  devices  for  every  worker  and  every 
type  of  work 

•  High-impact  business  solutions — from  corporate  wireless  email 
and  messaging  to  industry-specific  line-of-business  applications 

•  Extensive  knowledge  base  of  real-time  wireless  reference  archi¬ 
tectures  and  business  process  best  practices 

•  Dedicated  account  team  that  works  every  day  to  earn  the  right 
to  be  a  trusted  partner 

Cingular  has  the  expertise  to  help  your  company  maximize  the  bene¬ 
fits  of  wireless  data  solutions  while  helping  minimize  time,  risk  and 
cost  of  ownership: 

•  Dedicated  professionals — account  managers,  data  solution  con¬ 
sultants,  enterprise  architects  and  system  engineers — with  a 
passion  to  determine  how  wireless  can  create  tangible  business 
value  for  our  customers 

•  Ecosystem  of  alliances  with  trusted  market  leaders  like  Sybase 
and  Intel  to  help  deliver  end-to-end  solutions 

For  more  on  Cingular’s  mobile  solutions,  please  visit: 

www.cingular.com 


iny 


or  35  years,  Intel  Corporation  has  developed  technology  enabling 
the  computer  and  Internet  revolution  that  has  changed  the  world. 
Founded  in  1968  to  build  semiconductor  mem¬ 
ory  products,  Intel  introduced  the  world’s  first 
microprocessor  in  1971 .  Today,  Intel  supplies 
the  computing  and  communications  industries 
with  chips,  boards,  systems  and  software  build¬ 
ing  blocks  that  are  the  “ingredients”  of  computers,  servers,  and  net¬ 
working  and  communications  products.  These  products  are  used  by 
industry  members  to  create  advanced  computing  and  communica¬ 
tions  systems.  Intel’s  mission  is  to  be  the  preeminent  building-block 
supplier  to  the  Internet  economy. 

Intel  works  with  top  industry  players  to  bring  together  mobilized 
software,  comprehensive  wireless  networking  and  robust  mobile  client 
architectures  such  as  Intel®  Centrino™  mobile  technology  and  Intel® 
Mobile  Media  Architecture  to  enable  business  transformation  solutions. 

For  more  information  on  the  mobile  products  and  solutions  being 
delivered  to  the  industry  today,  please  visit: 
www.intel.com/go/mobilizedsolutions 
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ybase  is  the  largest  enterprise  software  company  specializing  in 
managing  and  mobilizing  information  from  the  data  center  to  the 
point  of  action,  helping  customers  to  create  an  information  edge. 

Sybase  data  mobility  solutions  manage  and  mobi¬ 
lize  information  to  the  front  lines  of  the  enter-  Q\7T)  A  CUT 
prise — whether  online  or  offline — delivering  ^ 

always-available  computing.  Sybase  provides 

open,  cross-platform  solutions  that  securely  deliver  information  and 
powerful  business  applications  to  the  Web  and  to  handheld,  desktop 
and  wireless  devices. 

Sybase  helps  customers: 

•  Optimize  investments  from  database  to  device  by  managing  and 
releasing  the  value  of  information 

•  Link  resources  by  integrating,  securing  and  speeding  the  flow  of 
information,  independent  of  data  source  or  destination 

•  Extend  reach  by  accessing  information  and  applications  easily  at  the 
point  of  action 

For  more  on  Sybase’s  industry-leading  data  mobility  solutions,  please 
visit:  www.sybase.com/ products/ mobilesolutions 


gies  are  standards-based,  meaning  they  can 
integrate  with  existing  heterogeneous  IT 
systems,  keeping  the  cost  of  a  mobility 
solution  low.  Even  wireless  devices  connect 
\  seamlessly  halfway  around  the  world 

thanks  to  GSM,  the  global  standard  for 
wireless  communications. 

Increased  Security — IT  professionals 
have  taken  advantage  of  robust  security 
standards  and  enterprise  products  to 
address  the  challenge  of  guiding  enterpris¬ 
es  to  design  and  implement  end-to-end 
security  solutions  that  meet  corporate 
security  guidelines. 

Manageable  and  Managed 
Solutions —  IT  organizations  have  put  in 
place  middleware  applications  that  enable 
the  integration  of  information  in  disparate 
systems.  Products  for  the  remote  manage¬ 
ment  of  mobile  devices,  such  as  Sybase 
iAnywhere  mobile  solutions,  allow  organi¬ 
zations  to  track  and  manage  the  growing 
number  of  mobile  devices. 

Reliable  Support — Finally,  business- 
focused  industry  players  provide  project 
management  and  deployment  support  to 
streamline  and  accelerate  large  mobile  and 
wireless  data  deployments,  customizing 
their  own  business  processes  to  meet 
demanding  customer  requirements. 


Leaders  at  the  Information  Edge 

To  be  successful  in  mobile  business 
endeavors,  business  leaders  rely  on  their 
trusted  technology  advisors  to  provide 
leadership,  expertise  and  experience. 
Enterprises  demand  that  technology  lead¬ 
ers  step  up  to  the  challenge  and  bring  the 
solutions  together,  end-to-end,  to  create 
immediate  business  value. 

That’s  the  shared  goal  of  Cingular,  Intel 
and  Sybase.  These  three  leaders  have  come 
together  to  provide  business  insight  and 
guidance  to  help  mobilize  business 
processes  for  maximum  value,  as  well  as  to 
provide  technical  leadership  to  help  CIOs 
make  the  right  technological  decisions.  In 
leading  companies  to  the  Information 
Edge,  these  three  leaders  help  create  archi¬ 
tecturally  sound  mobile  solutions  that 
enable  workforces  with  the  information 
they  need,  when  they  need  it,  across  wide- 
area  wireless  networks  and  local  area  wire¬ 
less  networks  seamlessly  and  securely — all 
to  achieve  clear  business  advantage. 

Providing  the  mobile  workforce  with  the 
information  it  needs,  at  the  point  where 
business  transactions  occur,  is  the  next 
evolution  of  optimizing  IT  systems  to  drive 
increased  revenue  for  a  business.  Org¬ 
anizations  have  an  enormous  opportunity 
to  transform  how  businesses,  employees 
and  consumers  interact.  Every  organiza¬ 
tion,  in  any  sector,  has  a  held  force  that  can 
benefit  from  these  mobilized  solution  capa¬ 
bilities.  The  time  to  fully  utilize  the  benefits 
of  mobilized  solutions  and  bring  informa¬ 
tion  to  the  held  force  is  now.  Cingular,  Intel 
and  Sybase  are  here  to  help,  til 


For  More  on  Creating  an 
“Information  Edge” 

Visit  http://domains.cio.com/infoedge 
for  case  studies,  white  papers,  news  and 
analysis,  and  please  be  sure  to  check  out 
the  interactive  webcast  featuring  Cingular  s 
Jeff  Bradley,  Intel’s  Chris  Thomas  and 
Sybase’s  Ojas  Rege  in  an  engaging  discus¬ 
sion  about  the  business  imperative  and 
technology  tools  driving  the  movement 
toward  the  Information  Edge. 
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In  order  to  ensure  a  true  peer  group  experience,  attendees  must  meet 
CIO  Executive  Programs'  qualifications. 


The  Resource  for 
Information  Executives 


Susan  Cramm  executive  coach 


In  short,  IT  should  attempt  to  disintermediate  itself  from  its  own 
supply  chain. 

In  case  you  think  I  have  lost  my  mind,  be  assured  that  while 
CIOs  are  enabling  their  partners’  self-sufficiency,  they  must 
also  ensure  that  IT  is  done  right.  (See  my  previous  column, 
“Give  Away  Authority  to  Gain  Control  Over  IT’s  Purpose,” 
zoww.cio.com/04010S,  on  the  fiduciary  role  of  IT.)  They  should 
establish  the  IT  principles,  decision  rights  and  processes  that 
govern  strategy,  investments,  architecture,  infrastructure  devel¬ 
opment,  delivery,  assets  protection  and  compliance. 

The  IT-Enabled  User 

The  only  way  that  the  “enabling  IT”  vision  will  become  a  real¬ 
ity  is  through  an  enabling  infrastructure— specifically,  a  devel¬ 
opment  and  delivery  environment  that  allows  business 
partners  to  add  or  modify  capabilities  while  ensuring  inte¬ 
gration,  compliance  and  operational  performance.  The  good 
news  is  that  environments  such  as  this  are  currently  under 
development;  the  bad  news  is  that  they  are  being  designed 
for  programmers  rather  than  for  hands-on  use  by  the  business. 
Take  the  example  of  a  large  financial  services  company  wherein 
the  CIO  is  focused  on  improving  programmer  productivity  by 
IS  percent:  He  is  missing  the  opportunity  to  increase  his  “vir¬ 
tual  programmer”  ranks  at  least  tenfold  by  failing  to  draft 
business  partners  to  work  closely  with  IT  and  its  products 
and  services. 

Realistically,  most  IT  organizations  are  far  from  possessing 
the  capabilities  necessary  to  enable  their  business  partners. 
The  key  to  moving  toward  the  “enabling  IT”  vision  is  to  ensure 
that  business  partner  self-sufficiency  is  a  goal  of  every  change 
that  is  made— to  governance,  processes,  applications,  mainte¬ 
nance,  service,  staffing,  education  and  so  on.  For  example,  an 
entertainment  company  CIO  has  created  a  document  man¬ 
agement  capability  that  allows  the  majority  of  “instances”  to 
be  implemented  by  the  end  users  who  work  directly  with  the 
records  retention  organization. 

By  enabling  their  business  partners’  IT  capabilities,  CIOs  and 
their  organizations  can  free  themselves  from  the  futile  pursuit 
of  trying  to  become  business  experts.  Effective  use  of  IT  requires 
intense,  senior-level  focus  on  critical  issues  such  as  encourag¬ 
ing  innovation  and  managing  change,  facilitating  effective  busi¬ 
ness  processes  and  knowledge-sharing  across  the  enterprise, 
building  quality  technical  infrastructures  that  support  rather 
than  stymie  change,  protecting  information  assets  and  ensur¬ 
ing  legal  compliance,  and  ensuring  that  benefits  are  real  and  the 
costs  are  reasonable. 

For  me,  enabling  IT  makes  sense.  It  addresses  IT’s  time-to- 
market  issue  by  exploiting  the  fact  that  business  users  have 
always  wanted  more  control  (remember  end  user  computing?), 
and  it  unleashes  the  resources  of  the  enterprise  toward  this  end. 

If  you  disagree  with  my  view  of  the  future  of  IT,  that’s  fine. 
But  my  challenge  to  you  is:  What’s  yours? 


Reader  Q&A 


Q:  It  seems  like  you  are  saying  that  agility  is  both  a  good  goal 
and  the  wrong  direction  for  IT.  You  write:  "Agile  is  a  great 
word  for  IT  because  it  speaks  to  the  core  IT  issues,”  and 
“even  the  most  agile  IT  organization— featuring  perfect  gov¬ 
ernance,  resource  management,  processes,  infrastructure, 
cost  transparency  and  organizational  structure— probably 
will  not  be  enough  to  satisfy  the  business’s  expectations  on 
time,  quality  and  cost.” 

A:  Agility  is  a  great  goal  for  IT  but  insufficient  as  a  strategy. 
The  current  role  of  IT  in  most  organizations  is  inappropri¬ 
ate.  Pursuing  any  strategy  that  assumes  more  of  the  same 
ultimately  will  lead  to  marginal  improvements  and  missed 
opportunities.  Expecting  agility  to  provide  IT  performance 
improvements  of  any  order  of  magnitude  is  like  asking  peo¬ 
ple  to  improve  their  looks  so  that  they  can  get  married.  In  the 
end,  there  will  be  some  improvement  in  outward  beauty 
but  little  assurance  of  reaching  the  goal. 


Q:  CIOs  need  to  earn  their  stripes  by  focusing  on  the  critical 
questions  you  outline  before  they  can  think  of  giving  away  IT 
roles  to  the  business.  Most  businesspeople  don’t  want  to  do 
IT,  they  want  IT  done  for  them.  A  balance  of  service  and  trans¬ 
parency  is  necessary  but  difficult. 

A:  The  current  definition  of  IT’s  role  requires  IT  to  serve  as 
the  advocate,  controller,  supplier  and,  many  times,  the  cus¬ 
tomer  for  IT  services.  Under  that  role,  CIOs  will  never  have 
enough  time  to  focus  on  critical  questions.  I  agree  that  busi¬ 
nesspeople  don’t  want  to  “do  IT”  under  the  current  terms  of 
engagement  that  call  for  them  to  be  included  as  a  resource 
on  a  work  plan  without  any  real  influence.  Yet  time  and 

time  again,  business 
managers  have  shown 
that  they  want  more 
control  over  IT. 

For  example,  an  IT 
client  of  mine  is  trying 
to  come  to  grips  with  a 
move  by  his  business  customers  to  build  business  analysis 
capability.  Their  goal  is  to  take  control  of  their  IT  strategy, 
project  priorities,  data  and  processes.  The  typical  CIO’s  knee- 
jerk  reaction  would  be  to  start  a  turf  war,  on  the  assumption 
that  IT  is  losing  market  share,  rather  than  focusing  on  how  to 
help  the  business  build  proficiency.  CIOs  should  modify  their 
working  relationships  and  approaches  to  factor  in  smarter, 
more  self-sufficient  customers.  QEI 

Susan  Cramm  is  founder  and  president  of 
Vaiuedance,  an  executive  coaching  firm  in  San 
Clemente,  Calif.  You  can  e-mail  feedback  to 
susan@valuedance.com.  P? 


Have  a  Leadership  Question? 


For  more  reader  questions  and  answers 
from  Susan  Cramm,  go  online  to 

www.cio.com/ieadership. 
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Deploying  our  ERP  application 
on  our  tight  deadline  would 
have  been  impossible.  With 
Citrix,  we  not  only  made  our 
deadline,  we  also  drastically 
reduced  our  deployment  costs.” 


Curtis  Robb,  CIO 

Delta  Air  Lines,  Inc. 


INFRASTRUCTURE  FOR  THE  ON-DEMAND  ENTERPRISE 

In  the  airline  business,  being  on  time  is  everything. 
And  for  Delta  Air  Lines,  their  ERP  deployment  was 
no  exception.  But  with  12,400  individual  desktops 
to  manage,  they  needed  a  faster  route  to  meet  their 
deadline.  So  they  turned  to  Citrix  for  a  simplified 
and  more  cost-effective  solution.  Not  surprising, 
considering  that  99%  of  the  Fortune  500  use  Citrix® 
software  to  deploy  applications  centrally  for  secure, 
easy,  and  instant  access  to  business-critical  information 
— anywhere,  anytime,  from  any  device.  We  call  it 
the  on-demand  enterprise.  And  it’s  helping  more 
than  120,000  of  our  customers  save  money  and 
reduce  IT  complexity.  To  learn  what  Citrix  can  do 
for  your  business,  call  888-820-7918  or  visit 
www.citrix.com. 
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The  Personalized  Economy 

Mass  production  has  hit  a  dead  end.  Today’s  consumers  increasingly  expect 
individualized  attention.  CIOs  can  help  their  companies  understand  this  shifting 
economic  landscape. 


A  quarter-century  ago,  MIS  directors  complained 
of  not  having  a  seat  at  the  strategy  table.  The 
CIO’s  role  eventually  emerged— a  technology 
visionary  and  bridge  to  a  gleaming  future.  Has 
that  dream  died?  In  recent  meetings,  I  have  been  surprised  by 
the  old  familiar  refrains— the  lack  of  strategic  clout,  the  difficulty 
of  sustaining  board-level  interest.  At  one  elite  gathering,  there 
was  a  palpable  sigh  of  relief  when  a  CIO  proclaimed,  “It’s  our  job 
to  build  the  sewers.” 

I  guess  he’s  right.  According  to  the  latest  figures,  75  percent 
of  the  typical  IT  budget  is  spent  on  legacy  systems.  Instead  of 
redefining  their  industries,  too  many  CIOs  became  prisoners  of 
the  status  quo— buried  in  mandates  for  cost  reduction  and  com¬ 
pliance.  But  while  they  were  trapped  in  the  sewers,  all  hell 
broke  loose  above  ground.  These  same  25  years  have  seen  a 
tectonic  shift  in  the  foundations  of  capitalism,  a  shift  that  has  left 
our  businesses  badly  out  of  sync  with  the  people  who  depend 
on  it  for  consumption  and  employment. 

Today’s  companies  remain  rooted  in  a  business  logic  invented 
a  century  ago  to  mass-manufacture  goods  for  a  then-new  pop¬ 
ulation  of  people  with  very  little  stuff  who  wanted  more.  The 
20th-century  corporation  required  a  strict  inward  focus  in  order 
to  manage  the  new  complexity  of  economies  of  scale.  It  empha¬ 
sized  the  concentration  of  resources,  command  and  control,  cost 
and  efficiency.  This  “managerial  capitalism”  produced  epic 
wealth  for  many  decades,  because  mass  consumers  wanted 
exactly  what  companies  were  skilled  at  giving  them:  cheap  goods. 

But  yesterday’s  mass  society  has  given  way  to  a  new  society 
of  individuals— people  who  are  more  educated,  informed,  expe¬ 
rienced,  traveled  and  connected  than  earlier  generations.  They 


3  2 


APRIL  1,  2005  |  www.cio.com 


ILLUSTRATION  BY  CAREY  SOOKOCHEFF 


IBM,  eServer,  the  eServer  logo,  OpenPower  and  Power  Architecture  are  trademarks  or  registered  trademarks  ot  International  Business  Machines  Corporation  in  the  United  States  and/or  other  countries.  Linux  is  a 
trademark  of  Linus  Torvalds  in  the  United  States,  other  countries,  or  both.  Other  company,  product  and  service  names  may  be  trademarks  or  service  marks  of  others.  ©2005  IBM  Corporation.  All  rights  reserved. 


FEEL  THE  POWER  OF  LINUX. 

Introducing  the  IBM  eServer™  OpenPower™  system.  With  this  server,  you 
can  have  it  all.  Power  Architecture™  technology  and  the  Linux®  operating 
system.  Outstanding  reliability  features  and  64-bit  computing.  This  is 
what  you’ve  been  waiting  for.  A  server  specifically  enhanced  for  Linux. 
It’s  a  purist’s  dream.  It’s  instant  entree  into  the  Linux  movement.  And  it’s 
an  affordable  way  to  adopt  Power  Architecture  technology  on  demand. 
Join  the  movement  at  ibm.com/eserver/pumpup 

(e)  server 
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are  shaping  a  profound  change  in  the  nature  of  consumption: 
It’s  no  longer  about  the  quantity  of  stuff,  but  rather  about  the 
quality  of  life.  A  growing  body  of  data  suggests  that  the  new 
consumer  is  in  search  of  something  that  isn’t  even  available  yet: 
advocacy  and  assistance  in  the  daily  work  of  negotiating  an  ever 
more  complex  life.  Toasters  and  mortgages  are  necessary,  but 
no  longer  sufficient.  For  example,  it’s  easy  to  find  a  competi¬ 
tively  priced  health  insurance  policy  but  difficult  (impossi¬ 
ble?)  to  find  an  insurance  company  that  will  really  be  there 
when  you  need  it— no  tricks,  no  strings.  Patients  can  get  access 
to  a  range  of  medical  specialists,  but  there’s  no  one  to  shep¬ 
herd  them  through  the  system— find,  sort,  integrate  and  explain 
critical  information— and  advocate  on  their  behalf.  We  can  pick 
from  among  comparably  priced  and  equally  uncomfortable 
airline  flights,  but  there’s  no  one  who  will  take  responsibility 
for  managing  a  complicated  travel  schedule,  transportation 
and  lodging,  needs  that  arise  on  the  trip  and  the  requirements 
of  your  household  while  you  are  gone.  Just  to  change  my  flight 
today— same  airline,  same  day,  two  hours  earlier  and  a  plane 
that  was  nearly  empty— I  paid  a  penalty  fee  of  $150.  When 
consumers  are  routinely  punished  for  their  intricate  lives,  it’s 
no  wonder  these  fragmented  transactions  no  longer  yield 
significant  margins. 

A  Perfect  Storm 

Today  there  is  a  growing  chasm  between  consumers’  needs 
and  the  business  organizations  they  depend  upon.  Too  often 
people  must  confront  a  wall  of  cluelessness  and  indiffer¬ 
ence— a  commercial  world  still  fitted  out  for  the  old  mass 
order.  This  chasm  can  be  seen  each  time  someone  spends  the 
evening  checking  her  phone  bill  for  bogus  charges,  finds  his 
routine  insurance  claim  rejected  or  spends  hours  on  the 
phone  trying  to  fix  a  malfunctioning  new  computer.  The 
chasm  is  expressed  in  these  brutal  facts.  Only  4  percent  of  U.S. 
adults  say  they  trust  their  HMO;  7  percent,  their  health 
insurer;  11  percent,  their  life  insurer;  12  percent,  their  telco. 
And  the  numbers  don’t  get  much  better.  Seventy-four  percent 
say  corporate  America’s  reputation  is  “not  good”  or  “terrible,” 
and  83  percent  say  that  big  companies  have  too  much  power, 
according  to  recent  polls. 

There’s  a  centuries-old  pattern  here:  A  business  model  has 
hit  its  stride,  and  its  success  produces  rigidity  and  resistance 
to  change.  But  society  continues  to  evolve.  People  move  on, 
taking  a  potential  marketplace  of  unfulfilled  needs  with  them. 
In  the  mainstream  economy,  businesses  can  no  longer  extract 
high  margins  for  their  products  and  services.  This  leaves  every¬ 
one  to  fight  over  a  shrinking  pie  in  a  downward  spiral  of  cost 
reduction  and  commoditization.  These  are  precisely  the  con¬ 
ditions  that  have  driven  so  many  CIOs  into  the  sewers. 

But  there  is  good  news  too.  Capitalism  is  a  book  of  many 
chapters.  In  the  past,  these  downward  spirals  set  the  stage  for 
new  competitors  to  emerge  with  business  models  that  reconnect 


with  people,  releasing  the  economic  value  concealed  in  their 
unmet  needs.  The  last  time  this  occurred  was  a  century  ago. 
Then,  a  growing  mass  of  people  was  hungry  for  goods,  but 
products  were  in  short  supply  and  expensive,  still  produced  in 
custom  workshops  and  small  factories.  Henry  Ford  was  among 
the  first  pioneers  to  perceive  the  yearnings  of  these  new  mass 
consumers,  and  he  invented  a  whole  new  approach— mass  pro¬ 
duction— to  meet  their  needs.  Ford’s  economic  revolution,  like 

In  the  new  economy,  there's 
no  more  room  for  adversarial 
behavior  that  ekes  out  a 
profit  at  the  expense  of 
consumers  or  employees. 

others  before  it,  arose  from  a  perfect  storm  of  three  converging 
forces:  new  markets  of  unmet  needs,  technologies  capable  of 
meeting  those  needs  and  a  new  enterprise  logic  that  linked 
people  and  technologies  in  a  new  pattern.  Today,  we  find  our¬ 
selves  in  the  gathering  winds  of  just  such  a  storm.  We  have  new 
markets  of  individuals  whose  very  alienation  and  mistrust  is 
the  opportunity  for  vast  innovation  and  immense  wealth  cre¬ 
ation.  We  have  the  kinds  of  technologies  that  can  meet  these 
new  needs— a  digital  medium  that  can  handle  the  complexity 
of  individualized  support.  This  will  become  the  ultimate  pur¬ 
pose  of  the  many  exciting  new  technical  developments:  wireless 
mobile  networks,  on-demand  computing,  peer-to-peer  and 
media  convergence  just  to  name  a  few.  Don’t  assume  that  the 
race  between  telco,  satellite  and  cable  companies  to  wire  the 
home  is  simply  an  opportunity  to  funnel  more  gadgets  and 
entertainment  into  each  living  room.  This  will  be  the  interac¬ 
tive  medium  through  which  individualized  support  bundles— 
including  home  health  care,  education,  travel,  financial  services, 
product  acquisition  and  much  more— will  be  piped  to  each 
family  and  each  person  at  a  price  they  can  afford. 

Finally,  we  are  just  beginning  to  see  the  emergence  of  that 
third  force,  a  new  enterprise  logic  of  “distributed  capitalism” 
that  knits  technologies  and  people  together  in  a  wholly  new  pat¬ 
tern.  It  shifts  the  game  from  the  adversarial  transaction 
economics  of  mass  production  to  a  new  advocacy-based  rela¬ 
tionship  economics  capable  of  reigniting  long-term  prosperity 
and  growth.  What  are  some  of  its  hallmarks? 

The  Consumer  Is  Queen 

Business  is  conducted  from  the  inside  out.  Business  processes 
are  organized  from  the  point  of  view  of  the  individual  con¬ 
sumer  and  aligned  with  the  individual’s  interests.  Forget  about 
what  niche  you’re  in,  or  even  what  industry.  The  new  enterprise 
asks,  “Who  will  want  us  to  support  them,  and  what  do  they 
need?”  Then  figure  out  whom  you  need  to  collaborate  with  to 
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“Guardian  uses 
Primavera 
to  run  IT 
like  a  business.” 

—  Dennis  S.  Callahan,  EVP  and  CIO 

The  Guardian  Life  Insurance  Company  of  America 


“Since  2000,  we’ve  cut  our  IT  budget  30% 
while  increasing  the  level  of  service  to  our 
business  units. 

Guardian’s  IT  operations  are  business-driven,  not 
technology-driven.  Our  business  units  define  their 
business  needs,  and  those  needs  drive  IT  investment 
strategies  and  plans.  With  Primavera’s  solution  for 
project,  resource  and  portfolio  management,  we  can 
judge  every  request  and  project  in  progress  against 
how  it  meets  predefined  business  requirements. 

We  don’t  waste  money  on  projects  that  don’t  give 
us  the  best  business  return  on  investment. 

Now,  our  business  units  and  IT  have  the  same 
objectives,  the  same  agenda,  the  same  priorities. 
Primavera’s  software  solution  plays  a  major  role 
in  making  that  happen.” 


PRIMAVERA 

project  success  =  business  success" 


View  the  Guardian  video 
and  learn  more  about  other 
Primavera  customer  success  stories 
at  www.primavera.com/guardian. 
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PROMOTED  TO  CIO. 


YOU  NEED  TO  GET  SMART  FAST 


How  do  you  get  off  to  a  smooth  start?  How  can  you  establish 
credibility  quickly?  And  how  can  you  manage  everyone’s 
expectations?  Turn  to  the  CIO  FOCUS™  on  FUNDAMENTALS 
OF  THE  CIO  ROLE— actionable  information  created,  filtered 
and  packaged  by  the  award-winning  editors  of  CIO  magazine. 

CIO  FOCUS™  is  delivered  right  to  your  desktop  giving  you 
immediate  access  to  the  information  you  need.  And  for  your 
future  reference  needs,  the  electronic  file  is  followed  by  a 
packaged  version,  shipped  within  72  hours. 


CIO  FOCUS™ 

Workforce  Management: 

Leading  IT  Staff  in  Times  of 
High  Stress  and  Low  Morale 

Securing  Information  Assets: 
Planning,  Prevention  and  Response 

Applied  Wireless:  Making  Wireless 
Work  in  Business 
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make  it  happen.  Wholly  new  “support  networks”  will  cluster 
around  individuals,  families  and  virtual  communities  with 
the  sole  purpose  of  supporting  their  aims. 

The  new  model  emphasizes  the  distribution,  rather  than  the 
concentration,  of  assets— people,  information,  authority,  tech¬ 
nology  and  so  on.  Economic  value  is  now  understood  as  dis¬ 
tributed  in  the  unmet  needs  of  each  individual:  It  is  lodged  in 
their  hearts  and  minds,  living  rooms  and  kitchens.  Value  is 
“realized”  in  relationships  of  advocacy  and  trust.  It’s  no  longer 
adequate  to  think  that  value  can  be  “created”  inside  factories 
or  offices. 

When  wealth  creation  depends  upon  authentic  relationships 
of  trust  and  advocacy,  there’s  no  more  room  for  adversarial 
behavior  that  ekes  out  a  profit  at  the  expense  of  consumers, 
employees  or  suppliers.  In  a  support  network,  all  behavior  is 
aligned  with  the  interests  of  the  individual  who  pays.  More 
alignment  means  more  cash,  more  profit  and  more  well-being 
distributed  throughout  the  network. 

eBay  is  an  example  of  one  small  step  through  this  looking 
glass.  It  realized  previously  hidden  economic  value  by  listening 
to  and  aligning  itself  with  the  needs  of  its  members.  It  learned 
through  trial  and  error  how  to  engineer  trust.  Riding  this  inside- 
out  distributed  value-based  logic  from  its  inception  in  1996,  it 

posted  gross  sales  of  $70  billion 
last  year.  But  eBay  has  addressed 
itself  to  just  one  tiny  slice  of  con¬ 
sumer  needs  and  in  one  very  lim¬ 
ited  format.  Imagine  hundreds  of 
eBays  using  a  variety  of  means  and 
methods,  able  to  link  and  coordi¬ 
nate  support  across  the  widest  pos- 
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You  can  read  an  excerpt  from  Shoshana 
Zuboff's  2003  book  online.  To  find  the 
excerpt,  go  to  the  online  version  of  this 
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History  teaches  us  that 
those  enterprises  that  move 
decisively  to  reconnect  with 
an  alienated  population  get 
rich  first. 

sible  spectrum  from  health  care  to  house  repairs— all  on  the 
consumer’s  terms. 

History  teaches  that  the  enterprises  that  move  decisively  to 
reconnect  with  an  alienated  population  get  rich  first.  But,  like 
the  thousands  of  companies  that  derided  the  new  disciplines 
of  mass  production  a  century  ago,  there  will  be  many  that 
cling  to  current  practices,  determined  to  ride  out  the  tide. 
They  are  unlikely  to  survive  the  next  decades.  CIOs  with  their 
unique  expertise  in  distributed  processing  and  digital  plat¬ 
forms  have  the  potential  to  help  define  the  new  enterprise 
logic.  We  need  the  CIO  that  was  imagined  a  quarter-century 
ago,  even  more  so  now.  It’s  time  for  the  CIO  who  stands  on  the 
shoulders  of  technology  to  become  the  champion  of  the  indi¬ 
vidual.  But  don’t  forget  to  bring  your  coat.  It  can’t  be  done 
from  the  sewers.  BE! 


Shoshana  Zuboff  is  the  coauthor  of  The  Support  Economy:  Why 
Corporations  Are  Failing  Individuals  and  the  Next 
Episode  of  Capitalism  (Viking  2003)  and  a  professor 
at  the  Harvard  Business  School.  E-mail  her  at 
zuboff_maxmin@thesupporteconomy.com.  Please 
send  your  comments  to  Executive  Editor  Alison  Bass 
at  abass@cio.com. 
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Audit  Change.  Prove  Control. 


Where  will  your  auditor 
find  material  weakness? 


A  Attend  our  free  Webcast  Sorting  out  SOX:  Making  it  Actionable 
for  the  latest  intelligence  on  Sarbanes-Oxley  from  legal  and  technology 
experts.  See  how  Tripwire  change  auditing  solutions  close  the  loop  on 
IT  process  deficiencies  before  they  ever  reach  the  magnitude  of 
material  weakness.  Learn  more  at  www.tripwire.com/cio. 
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: 

The  Price  of  Nice 

Machines  are  cheaper,  but  people  are  sweeter  Someday,  only  the  rich  will  be  privileged 
enough  to  deal  with  human  beings.  The  poor  will  be  forced  to  use  technology. 

BY  MEGAN  SANTOSUS 


I  ranted  in  this  space  last  December  about  the  less-than- 
satisfactory  experiences  I’ve  had  with  self-checkout  tech¬ 
nology.  Top  on  my  list  of  shame  was  The  Home  Depot. 
While  its  technology  was  certainly  annoying  and  inef¬ 
fectual,  what  really  ticked  me  off  was  the  customer  service  that 
came  along  with  it.  Or,  more  accurately,  the  service  that  did 
not  come.  Ever.  While  the  technology  crashed  and  burned  in  full 
view  of  at  least  a  hall-dozen  orange-smocked  employees,  not  one 
of  them  offered  to  help.  Indeed,  they  scattered  and  hid.  Even 
when  I  abandoned  the  sale,  no  one  appeared.  For  all  I  know,  the 
lightbulbs  and  wood  bundle  I  wanted  to  buy  are  still  sitting  at 
the  dusty  self-checkout  counter,  mute  testimony  to  a  sale  gone 
wrong,  a  business  strategy  gone  awry. 

Lest  I  appear  a  crank,  let  me  say  that  I’m  not  the  only  person 
who  has  suffered  so.  Nearly  a  dozen  readers  wrote  in  to  say 
that  they,  too,  had  tangled  with  those  self-checkout  lanes  and 
come  out  on  the  losing  end.  One  reader  wrote  that  a  recent  self- 
service  mishap  drove  him  back  to  his  local  hardware  store, 
where  he  has  rediscovered  the  joy  of  having  salespeople  treat 
him  as  if  he  were— imagine! —a  paying  customer. 

Yes,  the  prices  are  higher  at  Ye  Olde  Hardware  Shoppe.  Yes, 
he  thinks  it’s  worth  it. 

Those  letters  got  me  thinking.  Retailers  spend  a  hefty  amount 
of  money  on  self-service  and  CRM-types  of  technology,  with  the 
idea  that  such  high-tech  stuff  will  give  them  a  competitive  edge, 
either  by  allowing  them  to  cut  costs  (thereby  increasing  mar¬ 
gins)  or  improve  service  (thereby  increasing  volume),  or  ideally, 
to  do  both.  While  that  may  work  from  time  to  time,  what’s  more 
important  from  a  customer  perspective  is  the  no-tech  stuff. 
Let’s  face  it:  A  box  of  detergent  is  a  box  of  detergent.  It  may  be 
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a  few  pennies  more  here  or  a  few  pennies  less  there.  But  for  most 
of  us,  those  few  pennies  don’t  make  or  break  the  deal.  What,  in 
fact,  does  seal  the  deal  isn’t  streamlined  checkouts,  continuously 
replenished  inventories  or  convenient  price  scanners;  it’s  serv¬ 
ice.  And  by  that,  I  am  referring  to  people,  not  machines. 

The  Golden  Rule  of  Service 

So  many  of  life’s  daily  transactions  have  become  radically 
impersonal,  increasingly  mediated  by  technology.  We  don’t 
see  or  even  talk  to  our  friends;  we  e-mail  them.  We  don’t  go  to 
the  store;  we  shop  online.  We  don’t  rub  elbows  with  our  neigh¬ 
bors  at  the  theater;  we  punch  up  on-demand  movies  and  sit  in 
front  of  our  televisions.  As  technology  costs  fall,  human  costs 
will  inevitably  rise  in  comparison,  and  there  will  be  fewer  and 
fewer  opportunities  for  most  people  to  deal  with  other  human 
beings.  In  fact,  those  interactions  have  already  become  spe¬ 
cial.  Perhaps  that’s  why  I’m  willing  to  go  out  of  my  way  (or 
even  pay  a  premium)  to  experience  them. 


So  many  of  life's  daily  transactions 
have  become  radically  impersonal, 
increasingly  mediated  by  technology. 


For  example,  I’ve  got  at  least  four  supermarket  chain  stores 
located  within  10  minutes  of  my  house,  but  I  usually  spend  an 
extra  half  hour  driving  to  Whole  Foods  Market  or  Trader  Joe’s, 
two  relative  upstarts  that  sell  lots  of  organic  and  all-natural 
products.  While  Trader  Joe’s  prides  itself  on  low  prices,  Whole 
Foods  charges  as  much  for  a  gallon  of  milk  as  I  would  expect  to 
pay  for  a  six-pack  of  decent  domestic  beer.  What  both  stores 
have  in  common,  however,  is  competent  employees  who  obvi¬ 
ously  are  happy  to  help  customers. 

At  Trader  Joe’s,  Audrey  Dumper,  vice  president  of  market¬ 
ing,  won’t  divulge  specific  details  about  the  privately  held  com¬ 
pany’s  hiring  practices,  but  she  hints  that  the  grocer  isn’t  exactly 
engaging  in  rocket  science.  “First  and  foremost,  we  try  to  hire 
nice  people,”  she  says.  Without  that  foundation,  she  suggests, 
there’s  no  way  to  train  anyone  to  be  customer-service  oriented. 

I’m  as  time-strapped  as  anyone,  yet  I’ve  gone  to  Trader  Joe’s 
regularly  for  the  past  couple  of  years,  even  though  that  means 
I  have  to  visit  more  than  one  store  to  buy  the  stuff  I  need  every 
week.  Located  in  a  parking-space-challenged  strip  mall  with  the 
same  square  footage  as  a  decent  video  store,  Trader  Joe’s  doesn’t 
carry  a  wide  range  of  brands.  “Eighty  percent  of  our  products 

are  private  label,”  *  Dumper 
explains.  So  without  familiar 
brands  like  Coke  or  Tide  dominat¬ 
ing  the  shelves,  customers  may 
need  more  assistance  finding  what 
they  need.  Most  of  the  times  that 
I’ve  been  in  the  store,  at  least  one 
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employee  has  asked  me  if  I  needed  help.  Many  also  take  note  of 
what  I’ve  thrown  into  my  cart.  Just  the  other  day,  an  employee 
wanted  to  know  what  kind  of  sauce  I  put  on  the  butternut 
squash  ravioli.  “Alfredo,”  I  said.  “That  sounds  good,”  he  replied. 
“I  hadn’t  thought  about  that.” 

Therein  lies  the  simple  genius  of  Trader  Joe’s.  Employees  are 
there  to  help  customers,  but  they  are  also  there  to  learn  from 
them.  Dumper  confirms  this  strategy.  Without  focus  groups 
or  reliance  on  outside  market  researchers,  employees  who 
engage  customers  in  conversations  collect  useful  feedback. 
What’s  good  for  the  company  is  good  for  the  customers.  And 
it’s  all  accomplished  with  no  technology,  but  with  simple 
human  interaction. 

Let  Them  Eat  CRM 

Trader  Joe’s  is  unusual  in  its  attention  to  customer  service  but 
not  unique.  When  I  need  to  complete  my  shopping  for  the 
week,  I  head  to  Whole  Foods  Market.  Yet  my  experiences  with 
the  employees  are  worth  the  premium.  Whenever  I 
have  a  question  (such  as  what  happened  to  those 
wheat-free,  fruit-filled  toaster  cakes  I  liked),  I’ve  come 
to  expect  two  relatively  simple,  yet  increasingly 
unusual  things:  1. 1  will  find  an  employee  who  will  be 
able  to  help  me;  and  2.  That  employee  will  not  sigh 
heavily,  roll  his  eyes  and,  in  general,  make  me  feel  as  if  I  had  just 
asked  for  one  of  his  kidneys. 

Just  the  other  day,  I  was  hunting  for  a  can  of  sliced  mushroom 
pieces  with  stems.  (I  was  planning  to  make  a  dish  I  like  to  call 
Champignons  en  Aluminium  a  la  Santosus.)  A  quick  pass  down 
the  canned  vegetable  aisle  didn’t  reveal  its  whereabouts,  so  I 
continued  until  I  found  an  employee  restocking  the  snack  foods 
aisle  (an  aisle  with  which  I  am  intimately  familiar).  I  asked 
him  where  I  could  find  the  mushrooms.  He  didn’t  just  tell  me; 
he  stopped  what  he  was  doing,  accompanied  me  to  the  correct 
aisle  (the  one  I  had  breezed  down  earlier),  plucked  the  mush¬ 
rooms  off  the  shelf  and  handed  them  to  me,  bowing  (I  thought) 
slightly  from  the  waist.  And  then  he  asked,  “Is  there  anything 
else  I  can  help  you  find  today?” 

He  didn’t  say  it  snarkily.  He  said  it  like  he  meant  it. 

Fortunately,  I  have  the  luxury  of  time  and  the  discretionary 
income  to  shop  at  stores  like  Trader  Joe’s  and  Whole  Foods  Mar¬ 
ket.  I’m  willing  to  endure  a  bit  of  inconvenience  and  a  higher  tab 
because  the  service  is  better.  And  to  me,  that’s  worth  the  money 
and  time.  Unfortunately,  many  other  consumers  do  not  have 
the  resources  to  make  that  choice.  Instead,  they  must  patronize 
stores  where  bad-but-cheap  technology  has  replaced  good-but- 
expensive  people.  In  such  a  world,  customer- 
service  with  a  human  face  is  increasingly  being 
reserved  for  the  privileged  few.  HH 

Senior  Editor  Megan  Santosus,  a  people  person,  can 
be  reached  at  santosus@cio.com. 
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George  is  secure  in  his  information  workplace 
(and  he’s  not  afraid  to  show  it.) 
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Worrying  about  viruses  and  unwanted  content  can  hold  you  back.  That’s  why 
thousands  of  companies  across  the  globe  -  from  Fortune  100  organizations  to 
small  businesses  -  rely  on  Sybari  to  secure  their  information  workplaces, 
including  e-mail,  instant  messaging,  and  document  sharing. 

Our  unique  solutions  use  multiple  virus  scanning  engines  and  industry-leading 
antispam  and  content-filtering  technologies  to  stop  threats  before  they  stop 
your  business.  Make  the  move  to  Sybari...  and  experience  the  freedom  of 
security  and  productivity. 


Sybari 

SECURING  THE  INFORMATION  WORKPLACE 


To  learn  more, 

visit  www.sybari.com/cio05 
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Faced  with  a 
v  mandate  to  cut 
costs  while  creat¬ 
ing  competitive 
advantage,  CIOs 
have  turned  to 
IT-enabled 
innovation 

BY  ELANA  VARON 


In  a  world  that  is  constantly  changing,  data  keeps  us  grounded. 

The  right  statistics  communicate  succinctly,  tell  you  where  you  are.  In  the  four 
years  since  we  began  conducting  our  exclusive  “State  of  the  CIO”  survey,  we  have 
compiled  an  annual  benchmark  of  the  CIO  profession-  -your  reporting  relation¬ 
ships,  your  budget,  your  priorities,  your  challenges,  the  impact  IT  has  on  your 
companies  and  the  best  practices  for  your  success. 

Our  2004  survey  showed  a  new  mandate  emerging  for  CIOs— one  that 
requires  them  to  reduce  costs  while  simultaneously  using  IT  to  drive  competitive 
advantage.  This  seems  like  a  paradox,  but  successful  CIOs  have  learned  that  IT- 
enabled  innovation  is  the  way  out  of  the  bind.  Though  disruptive  innovations— 
those  that  change  the  dynamics  of  an  industry— get  most  of  the  publicity, 
innovation  (broadly  defined)  is  any  improvement  that  delivers  a  business  benefit. 
Even  investments  to  comply  with  Sarbanes-Oxley  can  be  considered  innovations 
if  the  result  is  that  executives  are  able  to  use  financial  data  more  effectively. 

“From  sheer  competitive  pressure,  every  business  now  realizes  there  is  no  time 
of  [being]  static,  that  change  is  constant,  and  innovation  is  required  every  moment,” 
says  Thomas  Gerrity,  professor  of  management  and  operations  and  information 
management  at  the  Wharton  School.  Even  cost  reduction,  Gerrity  says,  “requires 
innovative  thinking”  because  it  engenders  change  in  business  processes. 

Given  the  pressure  to  keep  moving,  the  context  in  which  you  operate  and 
innovate  is  what  defines  your  path  to  success.  It  makes  a  difference  whether  the 
brightest  programmers  flock  to  your  door  or  you’re  struggling  to  attract  fresh 
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Shaygan  Kheradpir,  Verizon 


Ken  Erdner,  Old  Dominion  Freight  Lines 


Robert  Taylor,  Fulton  County,  Ga. 


talent;  whether  the  goal  of  IT  innovation  is 
to  beat  the  competition  or  simply  to  keep 
up;  whether  you’re  rewarded  for  making 
money  or  for  saving  it.  So  for  “The  State  of 
the  CIO  2005,”  we  delved  more  deeply 
into  how  you  define  the  mandate  for  inno¬ 
vation  and  how,  given  that  mandate, 
you’re  coping  with  the  demands  of  your 
specific  environment. 

To  that  end,  we  went  on  the  road  to  pro¬ 
file  three  CIOs,  each  of  whom  works  under 
different  expectations  and  within  distinct 
constraints.  The  daily  experiences  of  these 
CIOs— chronicled  during  two  days  in  Jan¬ 
uary  when  our  writers  walked  the  halls  of 
corporate  headquarters,  attended  their 
meetings  with  them  and  interviewed  their 
colleagues  as  well— provide  a  window  into 
innovation  and  a  reality  check  on  the  state 
of  the  CIO. 

One  thing  these  profiles  make  clear  is 
that  no  matter  how  big  your  budget,  no  mat¬ 
ter  how  much  your  boss  values  your  strate¬ 
gic  vision,  being  a  CIO  is  a  hands-on  job. 
Even  CIOs  who  are  rewarded  for  thinking 
big  have  to  roll  up  their  sleeves  and  dig  into 
problems.  Michael  Earl,  professor  of  infor¬ 


mation  management  at  Oxford  University 
(and  a  member  of  CIO’s  editorial  advisory 
board),  says  that  corporate  priorities  for  IT 
regularly  swing  between  a  mandate  in 
which  CIOs  deliver  systems  and  one  in 
which  CIOs  engage  in  business  strategy  and 
innovation.  “Sensible  CIOs  pursue  a  bal¬ 
ance  between  high  performance  on  deliv¬ 
ery  and  on  the  strategy  and  innovation 
side,”  says  Earl.  “When  the  climate  starts  to 
ask  you  for  strategy  and  innovation,  you 
end  up  spending  50  percent  of  your  time  on 
that.”  But  you  can’t  ignore  tactical  details. 

With  an  IT  budget  of  approximately 
$1.5  billion,  Verizon  CIO  Shaygan  Kherad¬ 
pir  commands  resources  most  CIOs  only 
dream  of.  But  inevitably,  money  comes  with 
strings.  Verizon  has  pinned  its  business 
strategy  on  being  first  with  new  IT-enabled 
products  and  services,  and  it  is  Kheradpir ’s 
job  to  produce  them  at  a  steady  clip— even 
if  it  means  e-mailing  his  staff  at  2  a.m.  Read 
about  how  Kheradpir  manages  innovation 
in  “Sleepless  in  Manhattan,”  Page  52. 

Meanwhile,  at  Old  Dominion  Freight 
Lines,  a  less-than-truckload  shipper,  Vice 
President  of  Technology  and  Information 


Services  Ken  Erdner  juggles  the  demands 
of  a  budget-conscious  boss,  skeptical  end 
users  and  a  competitive  environment  that 
rewards  efficiency  above  everything.  Old 
Dominion  is  dominated  by  industry  giants 
such  as  FedEx  and  Yellow  Freight;  what¬ 
ever  innovations  Erdner  undertakes  are 
geared  toward  keeping  up  with  them  tech¬ 
nologically.  Erdner’s  situation  is  in  many 
ways  typical  of  what  CIOs  face  these  days, 
according  to  our  “State  of  the  CIO”  data. 
Find  out  more  about  how  he  tries  to  do  it  all 
in  “Everyone  Wants  Something  From  Ken,” 
Page  62. 

Robert  Taylor,  CIO  for  Fulton  County, 
Ga.  (which  encompasses  downtown 
Atlanta),  has  a  vision  of  a  county  that  uses 
innovative  IT  to  deliver  government  serv¬ 
ices,  but  he  constantly  bumps  into  politi¬ 
cal  reality.  For  the  elected  officials  who 
approve  Taylor’s  budget,  IT  is  more  an 
expense  than  an  investment.  As  a  result, 
Taylor  struggles  to  find  enough  resources 
to  attract  a  staff  with  the  right  skills  to  exe¬ 
cute  his  strategy.  Follow  Taylor  as  he  works 
the  system  in  “Where  There’s  a  Person, 
There’s  a  Problem,”  Page  70. 
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CIOs  as  Innovators: 
Catalysts  and  Coordinators 

Another  finding  that  emerges  from  the  pro¬ 
files  is  that  CIOs  embrace  their  function  as 
innovators,  even  in  business  environments 
where  change  is  difficult.  We  wanted  to 
learn  more  about  your  role  as  drivers  of 
business  innovation,  so  we  supplemented 
our  collected  “State  of  the  CIO”  research 
with  a  survey  on  the  purpose  of  IT  innova¬ 
tion  and  CIOs’  responsibility  for  it.  We 
learned  that  you  are  being  looked  to  for  lead¬ 
ership  in  innovation.  Slightly  more  than  half 
of  the  83  CIOs  who  responded  to  our  survey 
on  IT-enabled  innovation  said  the  percent¬ 
age  of  innovative  business  initiatives  that 
originate  within  the  IT  department  has 


increased  in  the  past  two  years. 

Furthermore,  65  percent  said  bringing 
ideas  for  IT-enabled  business  innovation  to 
the  table  is  a  significant  or  dominant  aspect  of 
their  roles.  And  enabling  business  innovation 
is  a  more  important  role  for  the  CIO  and  the  IT 
function  than  it  was  18  months  ago,  back  when 
cost-cutting  was  the  paramount  concern. 

The  need  for  cost-cutting  hasn’t  gone  away; 
it’s  simply  part  of  the  equation  now.  For  an 
overwhelming  majority  of  the  CIOs  who 
responded  to  our  survey,  reducing  costs  or 
improving  productivity  is  the  primary  pur¬ 
pose  of  innovation,  followed  by  improving 
customer  satisfaction  and  generally  creating 
or  enabling  competitive  advantage.  Thus,  Ful¬ 
ton  County’s  Taylor  pushes  a  new  system  for 


sharing  jail  management  information  as  part 
of  his  strategy  to  centralize  IT  and  eliminate 
redundant  systems;  Verizon’s  Kheradpir 
tweaks  a  new  voice  portal  to  minimize  the 
number  of  customers  who  request  repairs 
through  live  operators;  and  Erdner  pitches 
ideas  to  improve  efficiency  to  Old  Dominion’s 
vice  president  of  field  services. 

Of  course,  ideas  for  IT-enabled  business 
innovation  don’t  spring  fully  grown  from 
the  foreheads  of  CIOs.  Survey  respondents 
report  that  interaction  with  other  CXOs  and 
business  unit  leaders  is  the  primary  cata¬ 
lyst  for  the  IT  department’s  most  successful 
innovative  ideas.  That’s  as  it  should  be,  given 
that  the  results  of  innovation  are  focused  on 
business  goals,  and  it  jibes  with  last  year’s 


LEADERSHIP  for  Innovation 


In  2004,  you  told  us  about  a  new  mandate  emerging  for  IT:  Cut 

costs,  but  at  the  same  time  enable  innovation  and  create  competitive  advantage. 
Our  follow-up  survey  on  IT-enabled  innovation,  a  supplement  to  our  collected 
“State  of  the  CIO”  research,  delves  further  into  the  role  of  IT  executives  lead¬ 
ing  business  innovation.  The  conclusion:  IT-enabled  innovation  touches  every 
aspect  of  your  business  and  thus  has  become  a  significant  part  of  your  job. 


The  importance  of  your  position  as  an  innovator  has  increased,  but  your  relationship  with 
business  unit  leaders  is  still  critical  to  yoursuccess  at  all  stages  of  the  innovation  process. 


How  much  of  your  role  is  concerned 
with  innovation? 

Significant  aspect  of  my  role  59% 
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6% 
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Who  is  accountable  for  innovation  results? 

CIO/IT  and  business  units 


share  responsibility 

42% 

Business  units 

29%  A 

CEO 

12%  P 

IT 

8%  ^ 

COO 

5% 

Not  answered 

4% 

Methodology 


CIO’s  survey  on  IT-enabled  innova¬ 
tion  was  designed  to  gather  addi¬ 
tional  information  about  the  ways  IT 
is  contributingto  innovation  and  how 
IT  departments  go  about  these 
contributions.  The  survey  was  con¬ 
ducted  online  from  Nov.  1-30, 2004. 

A  select  group  of  CIOs  recognized  by 
CIO’s  editors  and  industry  leaders 
for  their  reputations  of  excellence  in 
effectively  managing  IT  were  invited 
to  take  the  survey.  Results  shown 
here  are  based  on  the  responses  of 
83  IT  executives.  In  terms  of  company 
size,  49%  of  the  respondents  were 
from  organizations  with  more  than 
1,000  employees.  A  broad  range  of 
industries  were  represented  in  the 
study,  including  manufacturing 
(11%);  finance  (10%);  insurance 
(6%);  federal,  state  and  local 
government  (9%);  and  wholesale/ 
retail/distribution  (7%). 
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“State  of  the  CIO”  finding  that  a  healthy  rela¬ 
tionship  with  other  CXOs  is  the  most  critical 
factor  for  your  effectiveness.  CIOs  “are  in  a 
position  of  partnering,”  says  Wharton’s  Ger- 
rity.  “They  can’t  [innovate]  on  their  own.  It 
takes  particularly  strong  interpersonal  skills 
and  broad  business  skills.” 

On  the  IT  side  of  the  ledger,  innovation  has 
far  less  to  do  with  the  latest  technology  than 
with  fundamental  aspects  of  IT  infrastruc¬ 
ture-such  as  revamping  the  IT  architecture, 
installing  data  warehouses  and  other  tech¬ 
nologies  to  facilitate  data  access,  and  devel¬ 
oping  Web  services.  Such  investments  enable 
IT  to  operate  more  efficiently  and  create  a 
technology  environment  in  which  continu¬ 
ally  changing  business  needs  are  easier  to 
address.  Eric  Sigurdson,  managing  director 
and  North  American  information  officers 
practice  leader  with  Russell  Reynolds  Asso¬ 
ciates,  says  improving  the  effectiveness  of  the 
IT  organization  is  part  of  the  job  description 
for  every  CIO  position  he  is  hired  to  fill. 

Emerging  technologies— such  as  radio  fre¬ 
quency  identification— have  a  lower  profile, 
in  part,  suggests  Oxford’s  Earl,  because  CIOs 
are  still  suffering  from  the  dotcom  hangover. 
“They  don’t  want  to  get  their  fingers  burned,” 
he  says.  Even  so,  “most  innovation  doesn’t 
start  by  asking,  Here’s  a  new  technology, 
what  can  we  do  with  it?  It  starts  by  saying, 
I’ve  got  a  big  problem  I  have  to  sort  out.” 

For  more  on  the  CIO’s  role  in  innovation, 
see  “Leadership  for  Innovation,”  Page  44;  and 
“New  Gains  from  Proven  IT,”  this  page. 


Dealing  with  Reality, 

Striving  Toward  the  Ideal 

The  three  CIO  portraits  in  this  issue  point  to 
another  conclusion  about  the  state  of  the 
CIO:  Success  as  a  CIO  happens  in  less  than 
ideal  conditions.  None  of  the  three,  for 
instance,  reports  to  his  company’s  CEO, 
although  most  CIOs  say  their  reporting  rela¬ 
tionship  is  a  key  factor  in  their  effectiveness. 
That’s  reality.  Yet,  there’s  a  model  for  every 
profession— an  ideal  to  strive  for. 

Turn  to  “Wanted:  The  Best  CIO,”  Page  83, 
to  find  this  model,  in  the  form  of  a  “job  spec” 
from  a  hypothetical  company  that  under¬ 
stands  the  value  of  IT.  To  develop  the  spec, 


NEW  GAINS  from  Proven  IT 

While  every  business  function  benefits  from  innovation, 

your  efforts  are  largely  concentrated  on  projects  that  reduce  costs, 
improve  customer  satisfaction  or  create  competitive  advantage. 

When  it  comes  to  choosing  technologies  to  enable  innovation,  you 
aren’t  rushing  to  the  bleeding  edge.  Most  IT-enabled  business  innova¬ 
tions  make  use  of  well-known  technologies,  and  infrastructure  invest¬ 
ments  predominate. 


Business  Benefits 


Top  Technologies 


Which  functions  benefit 
most  from  innovation? 

Customer  service _ 

70% 

Administration  and  finance 

■m  5i% 

Sales  and  market i ng 

42% 

IT  operations 

39% 

Supply  chain 

■MM  33% 

Logistics  and  distribution 

MM  31% 

HR 

HM 17% 

Security 

H 17% 

Manufacturing  and  product  design 

■I  16% 

Respondents  picked  their  top  three. 


What  is  the  goal  of 
innovation  efforts? 

Reduce  costs/improve  productivity 

■■■  81% 

Improve  customer  satisfaction/loyalty 

BHHfflH  71% 

Create  or  enable  competitive  advantage 

MMMM66% 

Generate  growth 

HMMlUg  54% 

Generate  new  revenue  streams 

i—  43% 

Optimize/streamline  the  supply  chain 

MM  37% 

Enable  global  operations/expansion 

H 16% 

Other 

ll% 

Respondents  checked  all  that  apply. 


What  are  the  key  technologies 
for  innovation? 

Redesigning  or  rationalizing  IT  architecture 

73% 

Data  access/warehousing 

BBMWBB55% 

Web  services 

1^W49% 

E-comrnerce  systems 

1 36% 


j  36% 

CRM/external  customer  service 

yT?T§934% 

Systems  integration  tools 

mnpi  34% 

Collaboration  technologies 

^^^B34% 

Knowledge  management 

1111111133% 

Wireless/mobiie  systems 

| _ |  "1 30% 

Information  security  technologies 

111  25% 

Supply  chain  automation 

Mi  16% 

Radio  frequency  identification 

16% 

Grid  computing 

|l% 

Other 

|l% 

Respondents  checked  all  that  apply. 
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We  are  known  for  our  ancient  civilizations. 

You  should  see  our 
state-of-the-art  delivery  centers. 


For  nearly  10  years 

Softtek's  Near  Shore  Outsourcing  Model 

has  proven  to  be  convenient  and  cost  effective. 

Our  highly  qualified  professionals  have  provided 
Application  Related  Services,  IT  Infrastructure  Support 
as  well  as  Business  Process  Outsourcing 


to  Fortune  50  companies 


MEK/CO 

SO  tftAK. 

Mexican  Outsourcing  Industry 
www.mexiconearshore.com 


Softtek 

Near  Shore®  Outsourcing  Services 
www.softtek.com/cio 
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Global  Survey  } 


{  STATE  OF  THE  dffi 


we  drew  on  our  “State  of  the  CIO”  data  and 
other  studies  about  the  role,  as  well  as  inter¬ 
views  with  executive  recruiters  and  CIOs. 
The  CIO  Executive  Council,  a  professional 
association  of  CIOs  founded  by  CIO,  helped 
us  refine  the  final  product. 

The  spec  defines  what  we  believe  are  the 
ideal  attributes  of  the  CIO  position,  includ¬ 
ing  executive  relationships,  staff,  responsi¬ 
bilities  and  processes.  It  also  describes  the 
background,  job  experience  and  skills  we 
think  a  CIO  should  have,  and  it  outlines  met¬ 
rics  for  measuring  the  CIO’s  performance. 

In  short,  we  think  the  ideal  CIO  is  a  strate¬ 
gic  business  leader,  with  outstanding  work¬ 
ing  relationships  and  accountability  and 
authority  over  all  aspects  of  IT  within  his  or 
her  company.  The  ideal  CIO  has  strong  soft 
skills,  such  as  communication  and  motiva¬ 
tional  ability.  He  or  she  should  have  a  technol¬ 
ogy  background  but  also  business  experience. 
And  he  or  she  should  be  measured  according 
to  the  contribution  that  IT  makes  toward 
achieving  the  company’s  strategic  goals. 

You  can  see  how  you  measure  up  to  our 
ideal  spec  by  taking  the  self-assessment  test, 
“How  Does  Your  Role  Stack  Up?”  on  Page  85. 
High  scores  indicate  that  you’re  a  strategic 
CIO,  within  striking  distance  of  the  ideal.  Low 
scores  indicate  that  you  have  much  work  to 
do  in  improving  your  role  and  the  role  of  IT 
within  the  organization.  The  quiz  includes 
tips  for  improving  your  situation,  with  links 
to  related  articles  from  the  CIO  archives.  (Find 
the  links  at  www.cio.com/04010S .) 

Finally,  compare  your  situation  to  that  of 
your  counterparts  around  the  globe.  Editors 
at  our  sister  CIO  magazines  in  Australia, 
Canada,  Germany,  Japan,  Southeast  Asia  and 
South  Korea  surveyed  their  readers  using  our 
“State  of  the  CIO”  questionnaire.  From  them, 
we  learn  that  connecting  with  the  business  is 
a  common  theme  among  CIOs  globally.  How¬ 
ever,  though  you  face  similar  pressures  and 
share  many  of  the  same  priorities,  the  context 
within  which  you  operate  differs  from  coun¬ 
try  to  country.  Find  the  highlights  in  “The 
State  of  the  CIO  Around  the  World,”  begin¬ 
ning  on  this  page.  BE] 
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The  State  of  the  CIO  Around  the 

WORLD 

BY  ELANA  VARON  AND  LORRAINE  COSGROVE  WARE 


In  our  first  global  “State  of  the  CIO”  survey,  your  counterparts 


in  Australia,  Canada,  Germany,  Japan,  Southeast  Asia  and  South  Korea  reveal 
how  similar— and  how  different— they  are  from  you.  For  the  most  part,  you 
share  the  priorities  of  making  your  business  more  efficient  and  aligning  IT  more 
closely  with  business  goals.  You  also  agree  that  top-notch  business  skills  are 
critical  to  your  success.  But  foreign  CIOs  diverge  in  how  they  allocate  their  time, 
in  their  views  of  the  role  of  IT,  the  hurdles  they  face  and  the  impact  they  will  have 
on  their  companies  this  year.  Turn  the  page  to  find  snapshots  of  the  state  of  the 
CIO  around  the  world,  and  how  you  compare. 


Focus  on  Efficiency 

CIOs  ranked  their  technology  and  management 
priorities.  Improving  business  and  IT  efficiency 
are  amongtheirtop  goals. 

Top  ©Technology  Priorities 
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Integrate/enhance  systems  and  processes 
Ensure  data  security  and  integrity 


2  2  2 


External  customer  service/relationship  management  3  3  3  3 

Redesign/rationalize  the  IT  architecture  1  3  3 

Implement  new  technologies  such  as  grid  computing, 

Web  services  and  RFID  2 

Other  (deploy  enterprise  content  management)  3 


Top  ©Management  Priorities 

Increase  business  efficiency 
through  IT-enabled  process  improvement 

1 

1 

1 

Align  IT  and  business  goals 

2 

1 

1 

2 

2 

1 

Improve  internal  customer  satisfaction/increase  usage  of  IT 

3 

2 

Create  competitive  advantage 

3 

3 

Control  IT  costs 

3 

2 

Develop  staff/leadership/business  skills 

2 

Enable/enhance  knowledge  management, 
leverage  intellectual  assets 

3 

Other  (new  system  development) 

3 

1 

2 

3 


Senior  Editor  Elana  Varon  ( evaron@cio.com )  coordi¬ 
nated  this  year's  “State  of  the  CIO"  special  report. 
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Take  cost  out  of  your  business  and  increase  productivity. 
No  matter  where  you  do  business. 
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The  Brother  Advantage 


Comprehensive  selection 
>■  Increased  productivity 
>■  Lower  acquisition  costs 


Brother  Printer,  Fax  and  Multi-Function  Center®  models  - 
designed  to  increase  productivity  while  decreasing  overhead. 


Reduced  consumable  costs 
>■  24171365  support  and  service 
>■  Free  evaluation  program 


Mobile  Printing  Solutions  Labeling  Solutions 


1 


Considering  that  over  94%  of  Fortune  1000  company  employees  work 
outside  corporate  headquarters*,  equipping  them  with  a  cost-effective 
solution  is,  to  say  the  least,  a  major  challenge. 

That's  why  Brother's  Commercial  Division  is  committed  to  providing 
superior  and  reliable  imaging  solutions  that  increase  productivity  while 
reducing  costs.  This  enables  businesses  like  yours  to  effectively  address  critical 
organizational  goals  and  challenges. 

But  it  is  our  product  reliability,  coupled  with  a  responsive  nationwide 
support  and  service  network,  that  has  companies  like  yours  putting  Brother  at 
the  top  of  their  requisition  lists. 

Brother's  Commercial  Division  welcomes  the  opportunity  to  put  our 
resources  to  work  for  you.  Contact  us  today  so  we  can  show  you  how  we  can 
positively  impact  your  bottom  line  while  enhancing  your  performance. 


Desktop  Laser  Solutions  Color  Laser  Solutions 


For  more  information,  call  1-866-455-7713. 


Multi-Function  Solutions 


Network  Printer  Solutions  Fax  Solutions 


*Purchase  Influence  in  Larger  American  Businesses  (Erdos  &  Morgan,  2001). 


©  2005  Brother  International  Corporation,  Bridgewater,  NJ  •  Brother  Industries  Ltd.,  Nagoya,  Japan 

For  more  information  visit  our  Web  site  at  www.brother.com 


The  State  of  the  CIO  Around  the 


WORLD  (cent.) 


Canada - 

GET  CLOSER  TO  BUSINESS 

CIOs  in  Canada  spend  the  bulk  of  their  time  meeting  with  their  company’s  executives  and 
working  with  both  IT  vendors  and  non-  IT  business  partners.  Their  U.S.  counterparts  say 
they  concentrate  on  planning  strategy,  in  addition  to  meeting  with  company  executives  and 
IT  providers.  CIOs  in  both  countries  agree  alignment  is  a  top  management  priority.  But  the 
Canadians  appear  to  be  further  ahead  in  getting  their  business  counterparts  to  share 
accountability  for  IT  investments,  which  should  have  an  effect  on  alignment. 


Where  the  Buck  Stops 


How  IT  spending  is  controlled 


Centrally  controlled  by  IT  organization 


United  States 

62%| 

Canada  42% 

■ 

Blended  control  by  IT  and  business  units 
orfunctions 


35% 
32%  I 


Directly  controlled  by  business  units  orfunctions 


Germany 


Top  Three  Activities 


How  CIOs  spend  most  of  their  time 


TALKING  STRATEGY 


IT  andthe  business  primarily  share 
accountability  for  ROI  from  IT  investment 


While  fewer  IT  leaders  hold  the 
C-level  title  in  Germany  than  in 
the  United  States  (24%  versus 
49%),  they  are  focused  on  busi  ¬ 
ness  strategy.  That's  what  56% 
of  IT  executives  in  Germany  are 
spending  most  of  theirtime  on, 
though  they'd  like  to  dedicate 
even  more  time  to  this  task. 
German  IT  executives  listed  the 
shortage  of  time  for  strategic 
thinking  and  planning  as  the 
second  biggest  barrier  to  their 
effectiveness,  after  unrealistic 
or  unknown  expectations  from 
the  business,  CIOs  in  the  United 
States  rated  unrealistic  or 
unknown  expectations  from  the 
business  and  inadequate  budgets 
as  their  top  hurdles  to  effective¬ 
ness,  with  lack  of  time  for  strate¬ 
gic  planning  ranked  third. 


United  States 


71%  Interacting  with  your  company’s  CXOs 
and  business  executives 

58%  Strategic  planning 

54%  Interacting  with  IT  vendors/outsourcers/ 
service  providers 


Germany 


56%  Strategic  planning 
55%  Leading  projects 
43%  Business  processes 

Respondents  checked  all  that  apply. 


30%B 

42%| 


IT  leadership  is  primarily  accountable  for 
ROI  from  IT  investment 


12%  U 
20% 


Business  unit  leadership  is  primarily 
accountable  for  ROI  from  IT  investment 


7%  | 
"9% 


Respondents  checked  all  that  apply. 


Australia 

ALL  ABOUT  MONEY 

Sixty  percent  of  CIOs  in  Australia  report  that  their  budgets  are  deter¬ 
mined  by  the  business  units,  which  accounts  fortheir  focus  on  gen¬ 
erating  revenue  through  IT  in  2005.  CIOs  in  Australia  say  that  IT’s 
greatest  impact  thisyearwill  be  on  revenue-generating  activities. 


IT's  Contribution 


UNIVERSAL  SKILLS 

The  keys  to  being  a  successful 
CIO  are  the  same  around  the  world. 

Like  CIOs  in  the  United  States,  IT  executives 
in  Southeast  Asia  and  Germany  cite  good 
communication  skills,  ability  to  think  strategi¬ 
cally,  and  understanding  business  processes  and 
operations  as  the  most  pivotal  skills  for  success. 


Expected  impact  of  IT  in  2004/2005, 
ranked  by  importance 


United  States 


1  Reduce  costs  through  efficiency/increased  productivity 

2  Enable/drive  business  innovation 

3  Create  or  enable  competitive  advantage 


Australia 


1  Generate  new  revenue  streams 

2  Grow  existing  revenue  streams 

3  Create  or  enable  competitive  advantage 
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South  Korea 


FOCUS  ON  LABOR 

CIOs  in  South  Korea  spend  more  oftheirtime  hiringand  managing  the  IT 
staff  than  CIOs  in  the  United  States.  South  Korean  CIOs  listed  this  activity 
second,  compared  to  fifth  in  the  United  States.  Hiring  and  retaining  IT  staff  is 
also  among  the  top  three  management  priorities  this  year  for  CIOs  in  South 
Korea,  versus  the  seventh  priority  in  the  United  States.  And  yet,  outsourcing  is 
somewhat  more  prevalent  in  South  Korea:  85%  of  IT  departments  there  report 
that  they  outsource,  compared  with  80%  in  the  United  States. 


Outsourcing  Levels 


How  much  of  IT  is  outsourced? 


United  States 


CIOs  in  the  United  States  who  outsource 
report  that  on  average  20%  of  their  IT 
labor  is  outsourced. 


South  Korea 


All  of  IT  34% 


Part  of  IT  66% 


Southeast  — 
Asia 

RISK  AVERSION 

Economic  risk  is  a  greater 
factor  for  CIOs  in  this  part  of 
the  world.  CIOs  in  Southeast 
Asia  listed  risk  and  uncer¬ 
tainty  due  to  volatile  eco¬ 
nomic  conditions  as  one  of 
the  top  three  hurdles  to  their 
effectiveness.  U.S.  CIOs  rank 
this  sixth.  Additionally, 
ensuring  data  security  and 
integrity  is  the  number-one 
technology  spending  priority 
this  year  for  Southeast  Asian 
CIOs.  It’s  numbertwo  in 
the  United  States,  behind 
integrating  and  enhancing 
systems  and  processes. 
Southeast  Asian  CIOs  are 
also  less  likely  to  take  risks 
themselves  when  it  comes  to 
driving  business  initiatives. 


Support  Versus  Leadership 


The  IT  department’s  role  in  the  organization 

IT  should  support  and  enable  predefined 
business  initiatives 


United  States  31% 


\mmnm 

IT  should  proactively  envision  business  opportunities 
andapplytechnology  to  achieve  them 


69% 

2 

539 

Japan 


STRATEGIC  PLANNING  PRIORITY 

Like  CIOs  in  the  United  States  and  Germany, 

IT  executives  in  Southeast  Asia  give 
strategic  planning  a  high  priority. 

But  getting  it  done  is  less  of  a  struggle  for 
Southeast  Asians.  They  rank  finding  time  for 
strategic  thinking  and  planning 
near  the  bottom  in  a  list  of  10  barriers 
to  their  effectiveness. 


Staffing  Levels  Hold  Steady 


ON  A  SPENDING  SPREE 

CIOs  in  Japan  reported  that  their  companies  allocate  a  larger 
percentage  of  revenue  to  IT  than  companies  in  the  United 
States,  and  they’re  spending  it  on  new  systems  and  applica¬ 
tions  such  as  Web  services  and  open  source.  Sixty-five  percent 
of  CIOs  in  Japan  said  that  the  IT  budget  represents  more  than 
10%  of  revenue  compared  with  an  average  of  5.6%  of  revenue 
in  the  United  States.  One  thing  Japanese  CIOs  are  not  spend¬ 
ing  money  on  is  their  staff. 


Will  IT  headcount  increase,  decrease 
or  remain  unchanged  this  year? 


United  States 


Increase 


48% 


Remain  unchanged  42% 

Decrease  9% 


Japan 


Remain  unchanged  66% 


Increase 


23% 


Decrease 


10% 


Percentages  may  not  add  up  to  100  due  to  rounding. 


Methodology 


Here  in  the  United  States,  we 
administered  C/0  third  annual 
“State  ot  the  CIO”  survey 
online  from  April  19  to  May  19, 
2004.  CIOs,  CTOs  and  vice 
presidents  in  charge  of  IT  were 
randomly  selected  from  our 
circulation  file  and  invited  to 
take  the  survey.  The  U.S.  sur¬ 
vey  findings  shown  are  based 
on  the  responses  of  544  heads 
of  IT  from  a  broad  range  of 
industries. 

Then  we  sent  our  question¬ 
naire  to  CIO's  editors  around 
the  globe  and  suggested  that 
they,  too,  launch  a  “State  of  the 
CIO”  study  in  their  countries. 
Through  a  combination  of 
online  surveys,  mail  surveys 
and  in-person  interviews, 
our  CIO  magazine  editors  in 
Australia,  Canada,  Germany, 
Japan,  Southeast  Asia  and 
South  Korea  gathered  data 
from  a  total  o<  1,433  IT  execu¬ 
tives.  The  editors  were  allowed 
to  tailor  the  questions  for  their 
specific  audience.  Results  are 
reported  according  to  the  U.S. 
survey  format. 
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The  $1.5  Billion  CIO  } 

Shaygan  Kheradpir, 

CIO,  Verizon 


i 


SLEEPLESS 

in  Manhattan 


The  pressure 
to  develop  new 
products  and 
services  for 
Verizon  never  lets 
up.  And  neither 
does  its  CIO. 

BY  ALICE  DRAGOON 


Pulling  all-nighters  is  nothing  new  for  Shaygan  Kheradpir.  In  grad 

school,  he  recalls,  “Our  brains  were  going  all  the  time.”  Now  CIO  of  Verizon,  he 
runs  his  more  than  7,000-person  IT  organization  much  like  a  college  lab,  a  fra¬ 
ternity  of  smart  people  who  welcome  the  crazy  hours.  Equally  demanding  of  him¬ 
self,  he  seems  to  have  taken  Verizon’s  corporate  slogan— “We  never  stop  working 
for  you”— as  his  personal  motto.  After  putting  in  a  10-  or  12-hour  day,  Kheradpir’s 
back  online  every  night  for  three  or  four  hours:  IMing  his  staff,  checking  the  day’s 
business  performance  metrics,  holding  conference  calls  with  developers  at  11  p.m. 
(His  wife  has  banned  the  late-night  speaker  phone  so  that  she  and  the  kids  can 
sleep.)  His  people  have  grown  accustomed  to  his  3  a.m.  e-mails  and  the  fact  that 
Kheradpir  might  want  to  discuss  them  by  7  a.m. 

But  even  with  all  that  pressure,  Kheradpir  claims  that  headhunters  have  told 
him  that  young  developers  consider  a  job 
with  Verizon  IT  to  be  a  prize.  Kheradpir 
believes  that’s  because  there’s  so  much 
going  on  at  Verizon  that  a  bright,  fresh-out-of-college  programmer  can  have  a  big 
impact  on  the  company  right  away.  (Verizon’s  annual  IT  budget  hovers  around 
$1.5  billion,  which  translates  into  hundreds  of  ongoing  projects— ranging  in  size 
from  $20,000  to  millions— that  keep  everyone  busy.)  Last  year,  Kheradpir’s 
retail  systems  group  implemented  40  major  new  systems  in  40  weeks  for  his 


The  events  in  this  story  occurred 
on  Jan.  12  and  13,  2005. 


AGENDA  2005 


::  Increase  customer  use  of  ::  Develop  new  ideas,  products  i:  Win  the  battle  for  the 

Verizon’s  self-service  Internet  and  services  for  Verizon’s  digital  home 

voice  portal  and  its  website  business 
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Verizon  CIO  Shaygan  Kheradpir  (center)  pushes  his  management  team,  including 


Fiber-to-the-Premises  (FTTP)  program,  even 
as  IT  operations  cut  costs  by  around  $50  mil¬ 
lion.  (Since  becoming  CIO  in  2002,  he’s 
reduced  the  IT  budget  by  one-third.) 

Kheradpir  pushes  so  hard  because  he  and 
Verizon  are  intent  on  winning  the  battle  for 
the  digital  home,  a  battle  that  places  IT 
squarely  on  the  front  lines.  While  competi¬ 
tors  are  economizing  by  laying  fiber  to  the 
curb  and  relying  on  traditional  copper  wire 
to  connect  curbside  fiber  to  residences,  Ver¬ 
izon  spent  $1  billion  last  year  to  lay  fiber  all 
the  way  to  the  customer’s  doorstep;  copper 
be  damned.  Verizon  now  offers  FTTP  in 
13  states.  And  without  copper  slowing 
things  down  (basic  DSL  over  copper  maxes 
out  at  about  8Mbps),  content  can  now  fly 
into  customers’  homes  at  speeds  of  up  to 
100Mbps.  This  move  sets  Verizon  up  to 
trump  cable  providers  by  selling  super¬ 
charged,  high-speed,  on-demand  video. 

Beyond  provisioning  and  supporting 
these  products  and  services,  Kheradpir  and 
his  group  are  dreaming  up  new  products 
themselves,  such  as  lobi,  a  service  that  mar¬ 
ries  the  public  telephone  network  with  the 
Internet.  lobi  allows  customers  to  link  all 
their  devices— home  and  work  phones,  PCs, 
televisions,  cell  phones  and  BlackBerrys— so 
that  they  can  access  and  control  content 
stored  on  any  single  device  from  whichever 
one  they  have  at  hand.  lobi  customers  could, 
for  example,  use  their  office  PC  to  screen 
calls  made  to  their  home  phone,  taking  just 
those  they  want  on  their  office  or  cell  phone. 

According  to  our  survey  on  IT-enabled 
innovation,  a  supplement  to  our  “State  of  the 
CIO”  research,  65  percent  of  CIOs  said  that 
bringing  innovative  business  ideas  to  the 
table  is  a  significant  (if  not  dominant)  part  of 
their  jobs.  Kheradpir  certainly  feels  that  way. 
The  lobi  concept  sprang  from  a  conversa¬ 
tion  between  him  and  Shadman  Zafar,  now 
a  senior  vice  president  who  runs  e-services 
and  architecture  for  Kheradpir.  In  2000, 
Kheradpir  sketched  the  idea  on  a  napkin  for 
the  head  of  retail,  marketing  and  sales.  Mul¬ 
tiple  prototypes  later,  lobi  launched  in  fall 
2004  in  New  England  and  New  York  City. 

To  speed  Iobi’s  journey  from  napkin  to 
launch,  Kheradpir  adapted  a  process  he  bor¬ 
rowed  from  the  venture  capital  world.  By 


pushing  for  fast  prototypes  in  30-day  cycles, 
he  could  course-correct  lobi  as  it  was  being 
developed.  He  claims  that  almost  every 
recent  idea  that’s  had  a  significant  impact 
on  Verizon’s  business  has  gone  through  this 
process  (see  “Creation  on  a  30-Day  Cycle,” 
Page  58). 

Kheradpir’s  ability  to  generate  ideas  and 
see  them  through  is  something  his  boss, 
Lawrence  Babbio,  vice  chairman  and  presi¬ 
dent  of  Verizon’s  Telecom  Group,  values 
highly.  “This  year’s  CIO  is  somebody  who  is 
as  creative  as  the  marketing  people,  as 
aggressive  as  the  operations  people  and  as 
much  in  control  as  the  financial  people,” 
says  Babbio.  “Shaygan  does  all  those  things.” 

In  short,  Kheradpir  gets  things  done,  even  if 
it  means  sacrificing  some  sleep  in  the  process. 

All  Aboard  the 
Innovation  Express 

On  the  39th  floor  of  the  Verizon  building, 
morning  fog  obscures,  the  view  of  lower 


Manhattan  as  11  people  crowd  onto  the  sofa 
and  upholstered  chairs  in  Kheradpir’s  office. 
It’s  8:30  a.m.,  and  this  is  the  first  in  a  series 
of  annual  IT  program  kickoff  meetings 
he  holds  with  his  top  IT  managers.  Kherad¬ 
pir  has  given  Zafar  and  his  e-services  and 
architecture  group  two  hours  to  update  him 
on  a  viciously  long  agenda  emphasizing  new 
products  invented  and  developed  by  Veri¬ 
zon  IT. 

Kheradpir  wastes  no  time  on  chitchat.  (His 
assistant,  Lori  Meyer,  admits  that  she  knows 
next  to  nothing  about  his  life  away  from  the 
office,  and  after  his  latest  vacation  coaxed 
from  him  only  the  fact  that  it  was  “great.”  She 
later  learned  that  he  threatened  to  check  the 
family  out  of  their  hotel  in  Jamaica  upon  dis¬ 
covering  that  it  had  only  dial-up  Internet 
access.)  He  wishes  everyone  a  happy  New 
Year  and  thanks  them  for  putting  together 
an  impressive  demo  event  at  the  International 
Consumer  Electronics  Show  in  Las  Vegas  the 
previous  week.  Then,  he  dives  into  the  first 
agenda  item,  extending  lobi  beyond  New 
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Senior  VP  Shadman  Zafar  (left)  and  Adriana  Rizzo  (right),  a  senior  IT  manager,  to  deliver  system  prototypes  every  30  days. 


England  and  New  York  City. 

The  first  slide  comes  up  on  the  plasma 
screen  on  Kheradpir’s  wall,  but  Kheradpir 
interrupts  before  Zafar  can  begin.  “I  know 
all  that  stuff,  go  ahead,”  he  says.  When  Zafar 
mentions  a  March  rollout  date  for  Iobi  Pro¬ 
fessional  (the  version  for  small  businesses), 
Kheradpir  wants  to  know  if  that  product  is 
still  “a  little  ‘blah’  featurewise.”  Right  now, 
yes,  he’s  told,  although  more  features  are  in 
the  works. 

“So  why  are  we  waiting  if  it’s  the  same 
thing  [as  the  consumer  version]?”  asks  Kher¬ 
adpir.  “Between  now  and  March,  there  are  a 
gazillion  other  features  we  could  stuff  in 
there.  So  why  wouldn’t  we?  I’m  not  saying 
do  it.  At  the  end  of  two  hours,  we’ll  have  three 
times  more  stuff  than  we  have  time  and  peo¬ 
ple  for.  But  put  this  on  the  list.” 

It  goes  on  the  list,  but  ultimately,  Zafar’s 
group  will  convince  Kheradpir  that  Iobi  Pro¬ 
fessional  is  compelling  enough  to  ship  as  is. 
(The  rollout  date  is  eventually  rescheduled 
for  early  February;  more  features  will  come 


later.)  In  the  meeting,  they  tell  him  that 
they’re  always  balancing  the  features  that 
people  want  against  ensuring  that  the  prod¬ 
uct  doesn’t  change  every  month. 

“Got  it.  Got  it.  Got  it,”  says  Kheradpir.  Next. 

The  discussion  moves  on,  and  Kheradpir 
questions  every  proposed  deadline,  want¬ 
ing  to  know  why  each  can’t  be  moved  up. 
His  modus  operandi  is  to  raise  the  bar  and 
then  raise  it  again.  He  admits  he  has  to 
monitor  himself  so  he 
doesn’t  push  too  hard.  As 
the  meeting  progresses,  he 
seems  to  sense  that  the  line 
is  approaching. 

“You  have  95  percent  of 
the  hard  work  done,”  he 
reassures  the  group.  “But 
now  you’re  sort  of  slowing 
down,  and  I  don’t  know 
why.”  He  offers  a  fractured 
football  analogy:  The  team 
has  10  balls  on  the  5-yard 
line,  and  they’re  trying  to 


push  them  all  through  at  once.  Playing  all  10 
means  they  can’t  score  until  the  second  half. 
Instead,  he  advises  them  to  pick  a  few,  push 
them  through  in  the  first  half,  and  then  build 
on  that  momentum.  Although  Kheradpir 
reserves  veto  power,  he  leaves  Zafar  and  his 
group  to  sort  out  where  to  concentrate  their 
efforts,  knowing  they’ll  be  more  committed 
to  goals  they  set  themselves. 

When  Zafar’s  group  is  ready  to  show 
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Kheradpir  the  latest  prototype  of  another 
IT  invention,  the  Verizon  One  phone,  Kher¬ 
adpir  doesn’t  want  to  waste  time  on  slides. 
He  heads  straight  for  the  device  and  imme¬ 
diately  expresses  doubts  about  its  usability 
because  he  can’t  read  what’s  written  on  its 
chrome  buttons.  He  picks  up  the  phone’s 
stylus  and  begins  tapping  on  its  PDA-like 
screen,  pleased  that  its  sensitivity  has 
improved.  The  screen  will  enable  one-click 
dialing  from  an  Iobi  address  book  or  Super- 
Pages  (Verizon’s  online  directory),  and  it 
will  let  users  view  maps,  local  movie  show- 
times  and  other  content.  The  device  also 
includes  a  plug-and-play  wireless  router  to 
link  home  PCs,  plus  a  DSL  modem. 

“This  thing  is  gonna  win,  unless  we 
screw  it  up,”  Kheradpir  says.  But  he  isn’t 
ready  to  pronounce  it  a  go.  “I’m  not  satisfied 
at  all  with  the  ergonomics,”  he  says.  “We 
need  to  go  into  startup  mode,  get  real  users, 
lock  them  in  a  room  with  a  bunch  of  our 
smart  people  and  have  them  use,  use,  use 
and  tell  us  what’s  confusing.” 


Zafar’s  group,  in  coordination  with  the 
retail  group,  is  already  doing  usability  tests 
on  Verizon  One  prototypes  in  Dallas  and 
Boston,  but  Kheradpir  wants  a  war  room. 
That  means  that  project  leaders,  developers 
and  designers  will  work  together  in  one 
open  room  lined  with  whiteboards.  Every 
few  hours,  everyone  will  stop  to  update  the 
group  on  where  they  are.  Goals  are  set  for 
the  next  few  hours,  and  everyone  goes  back 
to  work,  often  well  into  the  night. 

“You  have  to  have  a  war  room  to  break 
through,”  says  Kheradpir.  “The  last  10  to 
20  percent  of  a  major  project  involves  very 
fine  details  that  cross  boundaries  and  are 
hard  to  capture  and  understand  if  you  just 
work  in  a  business-as-usual  process.  Every¬ 
one  has  to  see  the  same  thing  in  real-time.” 

Kheradpir  tells  Zafar’s  group  to  make 
Verizon  One  “totally  instinctive,”  urging 
them  to  put  “restaurants  near  you”  or 
“movies  near  you”  right  on  the  display 
screen.  His  staff  objects,  saying  they  have  to 
aggregate  things  under  an  options  menu 


because  users  won’t  want  to  scroll  through 
40  things  to  find  what  they  want.  Side  con¬ 
versations  erupt,  but  Kheradpir  silences 
them  swiftly. 

“Mike,  Luis...” 

“I’m  listening,”  says  Mike  Naggar,  direc¬ 
tor  of  services  infrastructure  and  project 
leader  for  Verizon  One. 

“I’m  giving  a  problem  statement,”  says 
Kheradpir.  “Out  of  the  box,  this  has  to  put 
smiles  on  people’s  faces.  There  are  a  num¬ 
ber  of  aces  we’re  not  playing.  Think  of  it  as 
an  appliance,  not  as  a  PC.  We  want  cus¬ 
tomers  to  get  there  naturally  themselves.” 
By  putting  a  couple  obvious  things  right  on 
the  display  screen,  customers  will  under¬ 
stand  that  they  can  easily  get  the  screen  to 
display  what  they  want  to  see. 

The  device  is  slated  to  ship  in  Q2  of  2005, 
and  the  team  says  it’ll  be  ready. 

“We’ve  got  a  winner  here,  man,”  says 
Kheradpir.  “We’ve  just  got  to  close  the  deal.” 

“It’s  at  the  5-yard  line,”  says  Naggar. 

“This  is  one  of  those,”  Kheradpir  nods. 
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Why  Nighttime  Is 
the  Right  Time 

It’s  a  little  after  1  p.m.  and  Kheradpir  is  stand¬ 
ing  behind  his  desk,  eating  a  bowl  of  chicken 
soup  that  Meyer  brought  him  from  the 
employee  cafeteria.  (The  accompanying  bag 
of  chips  will  go  untouched.)  Top  managers  of 
the  retail  systems  group,  led  by  Fari 
Ebrahimi,  now  fill  his  sofa  and  chairs,  and 
Kheradpir  is  telling  them  that  it  will  be  a 
major  disappointment  if  customers  aren’t 
using  Verizon’s  website  or  self-service  voice 
portal  40  percent  of  the  time  they  do  busi¬ 
ness  with  Verizon  in  2005. 

“Are  you  guys  satisfied  you’re  tuning  this 
thing  fast  enough?”  he  asks,  referring  to  the 
voice  portal.  “Every  night  at  10  p.m.,  are  you 
going  over  what  you’ll  do  tomorrow?”  He 
exhorts  them  to  get  field  people  talking  with 
development  people  every  night  so  they  can 
improve  voice  portal  functionality  every  day. 

Kheradpir  is  a  big  fan  of  late-night  confer¬ 
ence  calls  as  projects  near  completion.  For 
most  developers,  that  might  translate  into  late 
nights  a  couple  months  out  of  the  year.  Zafar 
estimates  that  Kheradpir  took  part  in  late- 
night  meetings  every  night  for  almost  nine 
months  last  year.  The  primary  purpose  of 
these  meetings,  Zafar  says,  is  to  cut  red  tape 


so  that  projects  can  hit  deadlines.  In  fact, 
many  of  the  to-dos  are  assigned  to  Kheradpir. 

“I  usually  help  with  cross-departmental 
things,”  says  Kheradpir.  A  developer  might 
need  the  data  center  people  to  open  a  firewall 
so  that  he  can  make  a  fix;  a  call  from  the  CIO 
can  make  that  happen  in  two  hours  instead 
of  two  weeks.  But  occasionally,  Kheradpir 
dives  into  the  code  himself  if  a  team  is 
stumped  by  a  technical  problem. 

Kheradpir  believes  the  nightly  virtual 
meetings  help  teams  keep  their  projects  on 
track.  “The  more  people  meet  together  around 
a  very  focused  set  of  numbers  and  objectives, 
things  start  clicking,  and  the  machine  starts 
moving,”  he  says.  “The  objective  for  me  is, 
‘OK,  guys,  baseline  where  we  are  exactly,  and 
what  do  we  need  to  do  between  now  and 
tomorrow  night  to  be  in  a  better  place?”’ 

In  2003,  when  Kheradpir’s  group  first 
launched  Verizon’s  repair  line  voice  portal 
with  a  new  natural  language  speech  engine, 
customers  kept  hitting  zero  to  get  to  a  live 
operator.  At  nightly  conference  calls,  Kher¬ 
adpir  and  the  developers  went  over  the  day’s 
metrics  to  see  where  callers  were  dropping 
off  and  listened  to  voice  clips  from  just 
before  the  drop-offs.  Then  the  developers 
tuned  the  call  tree  design  each  day,  or 


tweaked  the  recognition  functionality  until 
the  numbers  started  moving  in  the  right 
direction,  with  fewer  and  fewer  callers  trans¬ 
ferring  to  the  live  operator. 

Barring  a  legitimate  family  conflict,  devel¬ 
opers  are  expected  to  dial  in  whenever  their 
team  has  a  late-night  session.  If  a  project  runs 
into  an  issue  that  might  jeopardize  hitting  the 
deadline,  “people  who  say,  ‘That’s  not  my 
problem,  I  just  work  9  to  5’  typically  don’t 
thrive  in  the  organization,”  says  Kheradpir. 
“Leaders  don’t  generally  want  them  on  their 
teams,  so  they  don’t  get  ranked  high.”  Accord¬ 
ing  to  Kheradpir,  up  to  10  percent  of  his  peo¬ 
ple  are  moved  out  each  year  (some  are 
transferred  within  Verizon;  some  leave;  some 
are  retrained)  to  make  room  for  new  talent. 
But  top-performing  developers,  especially 
those  right  out  of  college,  think  it’s  great  being 
in  on  conference  calls  with  the  CIO.  “Most 
doers  on  the  team  actually  like  it,”  says  Zafar. 
“They  see  the  support  and  excitement  from 
management  and  see  that  it  goes  all  the  way 
to  the  top,  that  these  guys  are  serious.” 


The  Wall  of  Shaygan 

The  Verizon  building  is  a  block  from  Time 
Square’s  neon  jungle,  but  a  coffee-table-size 


CREATION  on  a  -Day  Cycle 

Verizon's  process  for  ensuring  innovation  borrows  from  the  venture  capita!  world 


If  you  want  real  innovation, 

forget  about  continuous 
improvement,  says  Verizon 
CIO  Shaygan  Kheradpir. 

At  Verizon,  Kheradpir 
primes  the  innovation  pump  by 
looking  for  places  where  IT  can 
have  a  breakthrough  impact  on 
the  business.  He  then  chal¬ 
lenges  his  IT  group  to  come  up 
with  new  ideas  in  those  areas, 
which  in  turn  set  off  rounds  of 
discussion  and  brainstorming. 
When  a  potentially  big  idea 
emerges,  Kheradpir  takes  it  to 
a  line-of-business  head  or  to 


his  boss,  Lawrence  Babbio, 
vice  chairman  and  president 
of  Verizon’s  Telecom  Group.  If 
they  agree  that  the  idea  is  worth 
checking  out,  Kheradpir  takes  a 
venture  capital  approach  by 
giving  a  team  30  days  to  come 
up  with  a  prototype,  putting 
aside  any  constraints  that 
might  get  in  the  way,  such  as 
scalability,  usability  and  func¬ 
tionality  issues. 

“Show  me  what  this  could 
look  like,”  Kheradpirtells  the 
team,  “Bring  it  up  on  one  leg, 
hobbling.” 


If  that  version  shows  prom¬ 
ise,  the  team  gets  another  30 
days  to  expand  the  prototype, 
with  a  few  constraints  added 
to  the  mix. 

Projects  move  forward  in 
30-day  cycles.  If  they  survive, 
the  cycles  expand  to  60,  then 
90  days  as  more  constraints 
are  added  and  the  projects 
move  into  operational  readi¬ 
ness  tests. 

“Even  though  we’re  looking 
for  breakthrough  results,  we 
make  sure  [teams]  execute 
incrementally  so  we  can  course- 


correct,”  says  Kheradpir. 

Although  VC  firms  ditch 
ideas  that  don’t  pan  out  after 
two  or  three  30-day  cycles,  at 
Verizon,  they’re  not  automati¬ 
cally  killed.  “We  look  at  it  as 
a  learning  experience,”  says 
Kheradpir.  "We  backtrack  and 
try  again  because  we  still  need 
breakthrough  results.”  Gener¬ 
ally  a  dozen  new  ideas  are  in 
the  innovation  pipeline  at  any 
time;  Kheradpir  estimates  that 
more  than  half  make  it  all  the 
way  through  to  execution. 

-A.D. 
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WE’RE  PUTTING  COMPUTER 
R&D  WHERE  IT  BELONGS. 


In  your  Business . 


Dancing  robots  and  Artificial  Intelligence  make  great  press 
release  material,  but  what  exactly  do  they  do  to  improve 
your  business? 

At  Fujitsu,  were  concerned  with  R&D  that  helps 
CIOs  run  their  business  more  efficiently.  In  fact,  we  invest 
billions  of  dollars  annually  in  developing  technology  solu¬ 
tions  and  providing  the  right  products  for  our  customers 
to  achieve  maximum  enterprise  performance.  This  R&D 
effort  is  the  foundation  of  the  Fujitsu  PRIMEPOWER' 
and  PRIMERGY®  server  lines,  which  deliver  mission-critical 
reliability,  availability  and  serviceability. 

Thanks  to  our  real-world  R&D  philosophy,  we’ve 
become  a  company  that  offers  CIOs  the  high-performance 
mobile  computers,  scalable,  reliable  servers,  and  managed 
and  professional  services  they  need. 

If  you  are  looking  for  an  IT  partner  whose  R&D 
investment  actually  does  your  company  some  good,  visit 
us.fujitsu.com/computers/RD  or  call  1-800-831-3 183. 


FUJITSU 

THE  POSSIBILITIES  ARE  INFINITE 


PRIMEPOWER'  Servers 


LifeBook*  Notebooks 


Stylistic  Tablet  PCs 


PRIMERGY  Servers 
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The  $1.5  Billion  CIO  }- 


plasma  screen  on  the  wall  in  Kheradpir’s 
office  is  the  billboard  that  matters  most  at 
headquarters,  and  everyone  in  IT  is  happiest 
when  it  glows  a  reassuring  green.  The  Wall  of 
Shaygan,  as  everyone  calls  it,  is  a  highly 
sophisticated  executive  dashboard  that  Kher- 
adpir  and  his  IT  team  designed  so  that  he 
could  keep  an  eye  on  IT  systems  and  business 
metrics  throughout  the  day.  If  all’s  well, 
graphs  showing  Verizon’s  interaction  with  the 
market  (call  center,  website  and  voice  portal 
volumes,  sales  and  revenue)  trend  in  favor¬ 
able  directions,  and  grids  representing  more 
than  100  systems  remain  green.  A  yellow  box 


means  a  few  users  are  having  problems  with 
a  system;  orange  means  a  lot  of  users  are  hav¬ 
ing  problems;  red  means  a  system  is  out. 

Within  five  minutes  of  the  appearance  of 
a  red  box,  which  often  happens  on  Mondays 
after  weekend  upgrades  and  software 
changes,  managers  who  work  on  the  system 
that’s  down  are  expected  to  dial  in  to  a  con¬ 
ference  or  bridge  call  to  hammer  out  how  to 
resolve  the  problem  as  quickly  as  possible. 
Kheradpir  can  click  on  a  red  box  and  drill 
down  for  details  in  the  real-time  written  log 
of  each  bridge  call.  If  he  senses  that  a  prob¬ 
lem  could  have  a  pervasive  impact,  he  might 
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KEYS  to  Innovation 

Shaygan  Kheradpir’s  formula  for  developing  new 
ideas  and  making  them  happen 

1  j-  DEFINE  A  COMPELLING  GOAL  ::  People’s  attention  and  energy 
follow  their  passions.  Your  staff  needs  to  feel  that  they’re  working  to  make 
something  better,  not  just  to  earn  a  paycheck. 

2}  EMPOWER  PEOPLE  TO  PURSUE  THAT  GOAL  ::  Give  people 
autonomy  and  responsibility,  as  well  as  the  resources  they  need. 

3}  MEASURE  PROGRESS  ::  Kheradpir's  group,  for  example,  develops 
detailed  scorecards  with  business  clients  at  the  beginning  of  the  year.  They're 
posted  on  the  IT  intranet,  and  the  results  are  reviewed  quarterly.  Each  employee 
needs  to  commit  to  which  of  the  scorecard’s  metrics  they're  working  to  improve. 

4}  ENCOURAGE  NONLINEAR  THINKING  ::  Put  staffers  “two  in 
a  box,”  as  Kheradpir  calls  it,  by  asking  two  people  with  different  skills  from 
different  groups  to  work  together  to  attack  a  problem. 

5  BUT  EXECUTE  IN  A  LINEAR  WAY  •“  Advance  new  ideas  by 

asking  for  prototypes  to  be  developed  in  30-day  cycles.  As  big  projects  hit  the 
homestretch,  hold  daily  status  meetings  and  set  goals  for  the  next  24  hours. 

6}  THINK  FLAT  =  Business  can  move  more  quickly  without  bureaucratic 
layers.  Having  all  the  major  players  on  a  project  working  together  in  a  war  room 
improves  communication  and  coordination  in  the  final  stages  of  a  project. 

7  }  BE  HANDS  ON  "  Cultivate  relationships  with  employees  on  the  front 

lines  so  that  you  can  understand  their  issues  and  get  direct  feedback  on  how 
systems  are  working. 

8  ]■  HIRE  TOP  TALENT  ANNUALLY  ::  Most  of  what  you  learned  in 

school  is  already  outdated.  Bring  in  new  talent  from  top  schools  each  year. 

9  ]"  REMOVE  BARRIERS  ::  Encourage  staff  to  identify  red  tape,  then 

cutthrough  itforthem.  That's  your  job.  -A.D. 


jump  onto  the  bridge  himself.  “I  want  to 
make  sure  we  have  the  deepest  experts  on  it 
if  I  get  a  sense  of  the  gravity  of  the  situation,” 
he  says.  If  he’s  not  in  the  office  when  some¬ 
thing  goes  red,  he  gets  an  alert  on  his  Black- 
Berry,  with  a  link  to  the  bridge  log  and  the 
dial-in  number.  At  4  a.m.,  Kheradpir  has 
found  himself  tracking  down  an  expert  in 
Australia  to  resolve  a  technical  glitch  and 
get  a  system  back  in  business  by  8  a.m. 

“We  sometimes  pull  all-nighters,”  says 
Kheradpir.  “Verizon  is  so  big,  so  vast,  so  many 
things  happen.  These  days  there’s  no  mar¬ 
gin  for  error.  The  business  runs  around  the 
clock,  so  we’ve  got  to  go  around  the  clock.” 

Throughout  his  annual  kickoff  meetings 
with  his  IT  managers,  Kheradpir  refers 
often  to  the  Sea  of  Green,  that  happy  state 
when  everyone  in  IT  can  concentrate  on 
innovation  instead  of  putting  out  fires. 
“Keep  it  green”  has  become  IT’s  mantra.  For 
Kheradpir,  time  spent  on  the  bridges  resolv¬ 
ing  problems  is  time  taken  away  from  his 
real  job:  moving  the  business  forward. 


A  Long  Day’s  Journey 

At  6:45  p.m.  Kheradpir  leaves  to  meet  his 
wife  and  kids  for  dinner  at  ESPN  Zone  in 
Times  Square.  By  9:30  or  10,  he’s  home, 
IMing  his  staff  and  reviewing  (and  ques¬ 
tioning)  the  day’s  metrics. 

He  calls  it  quits  around  1  a.m. 

“Frankly,  I  don’t  know  any  other  ap¬ 
proach,”  he  says.  “I  really  have  to  understand 
the  subject  matter  to  be  able  to  manage  per¬ 
formance,  to  be  able  to  explain  to  others  what 
we’re  doing,  why  it  matters.” 

And  for  Kheradpir,  Verizon’s  business  mat¬ 
ters  deeply.  In  fact,  Zafar’s  team  members  say 
it’s  hard  to  believe  that  Kheradpir  thinks 
about  anything  else,  ever.  “The  biggest  thing  I 
worry  about  every  day  is  how  can  we  go  there 
faster,  develop  more  compelling  products, 
drive  revenue,  bring  costs  down,  delight  cus¬ 
tomers,”  Kheradpir  says.  “Every  night  I  think 
we  can  do  more,  do  more,  do  more. 

“My  big  challenge,”  he  says,  “is  to  figure 
out  when  enough  pressure  is  enough.”  E3EJ 


Senior  Editor  Alice  Dragoon  can  be  reached  at 
adragoon@cio.com. 
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What  if  your  assets  had  appreciating  value  instead  of  depreciating  value? 

With  Maximo®  Enterprise  Suite,  you  not  only  see  the  performance  of  assets  across  the  agency,  but  also  the  untapped 
potential  within  them.  So  you  can  make  every  stage  of  every  asset  life  cycle  more  valuable.  And  gain  the  information  and 
the  control  you  need  to  more  closely  align  real  and  personal  property  with  business  strategies.  To  learn  more  about  our 
Strategic  Asset  and  Service  Management  solutions,  call  800-326-5765  or  download  our  white  paper,  Maximizing  the 
Return  From  Asset  and  Service  Management  Systems,  at  www.maximoenterprise.com/cio 

COUNTED  CONTROLLED  MAXIMIZED 

©2005.  MRO  Software,  Inc.  All  rights  reserved.  Maximo  is  a  registered  trademark  and  MRO  Software  is  a  trademark  of  MRO  Software,  Inc 


mro  software 

make  it  all  count 
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The  Man  in  the  Middle  } 

Ken  Erdner, 

VP  of  technology  and  IS, 

Old  Dominion  Freight  Lines 


EVERYONE 


Wants  Something  from  Ken 


If  nothing  else,  Old  Dominion  Freight  Lines,  a  70-year-old  trucking 

company,  is  diverse,  a  collection  of  seemingly  ill-fitting  parts  and  fractious  forces. 

Its  president,  for  example,  expects  his  company  to  be  as  technologically  inno¬ 
vative  as  its  Fortune  500  competition.  At  the  same  time,  Old  Dominion  (OD)  recently 
acquired  a  trucking  company  in  which  the  workers  had  rarely  used  computers  and 
would  rather  not  learn,  thank  you  very  much. 

Since  its  founding  in  1934,  Old  Dominion  has  been  owned  by  the  Congdon  fam¬ 
ily,  and  they  like  to  run  it  in  their  own,  relatively  idiosyncratic  way.  But  this  is  also 
a  public  company  whose  thousands  of  shareholders  expect  and  demand  not  only  a 
good  return  on  investment  but  also  a  strict  adherence  to  federal  regulations. 

Old  Dominion  has  many  IT  managers  who  bring  years  of  experience  at  other 
companies  to  the  office,  but  it  also  has  others  who  joined  the  department  straight  out 
of  high  school  and  know  only  one  way— 

,  .  The  events  in  this  story  occurred 

the  OD  way— to  do  things.  0„  yan,  6andz  200S. 

And  in  the  middle,  charged  with  mak¬ 
ing  all  this  work,  is  Ken  Erdner.  As  vice  president  of  technology  and  information 
services  at  Old  Dominion,  an  $824.1  million  less-than-truckload  (LTL)  carrier,  he 
juggles  the  often  contradictory  needs  of  these  diverse  constituencies  for  more 
than  10  hours  each  working  day.  But  that’s  only  one  of  Erdner ’s  challenges.  He  also 
must  meet  the  rapidly  increasing  IT  needs  of  the  Thomasville,  N.C. -based  company 


::  Develop  new  wireless  ::  Find  and  hire  employees  ::  Improve  the  revenue- 
capabilities  for  sales-  with  hot  skills  to-IT-employee  ratio 

people  in  the  field 


Old  Dominion 
Freight  Lines’ CIO  is 
v  competing  against 
companies  with 
more  money  and 
manpower  than 
he  has.  So  he  has  to 
work  harder  and 
smarterthantheydo. 

BY  STEPHANIE  OVERBY 


AGENDA  2005 
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with  relatively  minimal  resources— a  small 
staff  of  80,  limited  funding  and  even  less  time. 
And  he  has  to  manage  his  $10  million  budget 
well  enough  to  compete  with  competitors 
who  have  more  than  10  times  his  resources. 

But  remarkably,  Erdner,  by  all  accounts, 
is  doing  just  that.  Since  David  Congdon  took 
over  as  president  in  1997  and  put  Erdner  in 
charge  of  IT,  Old  Dominion  has  been  growing 
at  double-digit  rates.  With  revenue  soaring 
23.5  percent  last  year,  this  rise  has  left  its 
biggest  rivals— Yellow,  ABF  and  Con-Way— in 
the  dust.  And  during  Erdner’s  tenure,  the 
company’s  attitude  toward  IT  has  evolved.  In 
1999,  he  was  promoted  to  vice  president  and 
given  a  seat  at  the  corporate  table,  a  first  for  a 
CIO  in  Old  Dominion  history. 

None  of  this— the  growth,  the  transforma¬ 
tion,  the  efficiency— has  been  easy  to  achieve, 
but  Erdner  (with  the  help  of  his  close-knit 
staff)  is  getting  it  done  through  a  combina¬ 
tion  of  hard  work,  a  good  sense  of  humor,  a 
clear  sense  of  purpose  and  a  minimum  of 
three  cups  of  strong  coffee  a  day. 

Faster,  Faster,  EASTER ! 

Erdner  knows  his  boss  put  him  in  charge  to 
move  this  old-fashioned  company  in  a  new 
direction,  to  grow  without  sacrificing  the 
speed  and  agility  possible  in  a  smaller  com¬ 
pany.  “I  try  to  instill  a  sense  of  urgency,”  says 
Erdner.  But  doing  things  fast  and  right  with 
limited  resources  is  a  constant  challenge. 

Erdner  likes  to  put  a  positive  spin  on 
things.  With  80  people  in  IT  supporting  more 
than  8,300  end  users  (nothing  is  outsourced), 
he  knows  that  his  people  are  stretched  thin. 
But  hey,  things  aren’t  as  bad  as  they  were  for 
Wichita  Southeast  Kansas  Transit  (WSKT), 
the  $68  million  trucking  company  Old 
Dominion  acquired  on  Jan.  15.  “They  had 
500  full-time  employees  and  only  two  peo¬ 
ple  in  IT,”  Erdner  relates.  “We’ve  acquired  six 
companies  since  I’ve  been  here,  and  they  all 
had  fewer  IT  people  than  we’ve  had.” 

Erdner  knows  his  company  is  on  the  low 
end  of  IT  spending  in  the  LTL  industry.  At 
1.3  percent  of  revenue,  he’s  spending  less  than 
half  of  what  his  Fortune  500  competitors 
spend— and  that  includes  the  OD  phone  bill 
that  somehow  found  its  way  into  Erdner’s 


budget  and  stuck  there. 

Time  isn’t  on  Erdner’s  side  either. 
Today,  Thursdayjan.  6,  is  typical.  He’s  in 
before  8  a.m.  and  won’t  leave  until  well 
after  6  p.m.  Paperwork  and  unanswered 
e-mail  pile  up  as  he  shuttles  to  an  average 
of  eight  meetings  a  day;  his  only  break  is 
a  quick  trip  to  Subway  for  lunch.  He  has 
to  sign  every  invoice  for  his  department. 

He  has  no  assistant.  (Neither  does  the 
CEO;  it’s  the  OD  way.)  Working  holidays 
and  long  weekends  are  the  norm  because 
that’s  when  the  company  (open  24/7 
every  day  except  Christmas)  slows  down 
enough  to  make  major  IT  upgrades. 
Erdner  has  been  in  the  office  every 
Thanksgiving  since  he  started. 

His  team  works  just  as  hard,  maybe 
harder.  Consequently,  Erdner  inter¬ 
views  each  job  candidate,  conducting 
an  average  of  one  interview  a  week.  “It’s 
the  most  important  thing  I  do,”  he  says, 
even  though  he  plans  to  add  only  20 
workers  over  the  next  five  years.  He 
admits  that  he’d  love  “the  luxury”  of 
another  Web  programmer  and  another 
worker  in  his  imaging  department.  But 
he  hasn’t  been  able  to  make  the  num¬ 
bers  work  yet.  Maybe  next  year. 

Money  isn’t  Erdner’s  only  problem. 
After  a  long  search,  OD  recently  hired  a 
programming  analyst  to  work  on  the 
SAP  HR  implementation  scheduled  for 
Q2.  “It’s  hard  to  find  SAP  experience,” 
says  Erdner,  “except  in  India.”  And  he’s 
ruled  that  out.  Erdner  believes  only  his 
own  staff  knows  the  intricacies  of  the  busi¬ 
ness  well  enough  to  do  the  work. 

But  by  his  own  admission,  Erdner’s  peo¬ 
ple  had  “zero  experience”  before  recently 
installing  SAP  financials,  which  meant  he 
had  to  provide  Applications  Development 
Manager  Sheila  Burwell  and  her  staff  with  a 
lot  of  outside  training.  That  eviscerated  the 
budget  for  everyone  else.  “I  always  ask  for 
lots  of  education  in  my  budget,  but  my  boss 
will  only  allow  so  much,”  says  Erdner,  who 
tries  to  get  everyone  out  for  a  week  of  training 
at  least  every  18  months. 

Implementing  SAP  in-house  also  meant 
that  Burwell’s  team  worked  double-time  to 
get  the  system  up,  on  schedule,  by  Jan.  1. 


Ken  Erdner 

TITLE:  VP  of  Technology  and 
Information  Services 

COMPANY:  Old  Dominion  Freight  Lines 

REPORTS  TO:  David  Congdon, 

President  and  COO 

I.T.  STAFF:  80 

BUDGET:  $10  million 

EXPERIENCE:  B.S.  in  computer  science, 
Youngstown  State  University;  credits 
toward  an  MBA.  Application  manager, 

Old  Dominion  Freight  Lines,  1997-1999. 
Various  IT  staff  and  management  posi¬ 
tions  from  1981-1997. 

PERFORMANCE  MEASURES: 

•  Quality  of  the  system’s  infrastructure, 
including  uptime,  response  time, 
access  and  availability 

•  Quality  of  application  implementation, 
including  testing  and  integration 

•  Delivery  of  ROI  or  competitive  advan¬ 
tage  from  IT  systems 

Burwell  was  so  overloaded  that  she  couldn’t 
keep  up  with  managing  her  own  three  direct 
reports.  That,  too,  fell  to  Erdner.  “She  couldn’t 
focus,”  explains  Erdner,  who  volunteered  to 
be  his  department’s  fire  coordinator  because 
he  couldn’t  bear  asking  anyone  on  his  staff  to 
be  the  last  person  out  in  a  disaster. 

All  of  Erdner’s  six  direct  reports  would 
love  to  have  more  help.  That’s  especially  true 
today,  as  Marc  Weiler,  the  manager  respon¬ 
sible  for  getting  13  recently  acquired  serv¬ 
ice  centers  in  the  Midwest  up  and  running  in 
two  weeks,  provides  an  update  at  his  regular 
8:30  a.m.  Friday  meeting  with  Erdner.  A 
paralyzing  ice  storm  in  Kansas  yesterday 
kept  much  of  the  computers  and  telecom 
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where  information  lives 


Fr:  a  wide  range  of  information  management  challenges 


To:  a  wide  range  of  software  to  overcome  them 


EMC  SOFTWARE  GIVES  YOU  MORE  OPTIONS,  MORE  CHOICES.  You  have  all 
kinds  of  information  management  challenges.  EMC  has  the  software  to  help  you  overcome 


them.  Whether  you’re  dealing  with  storage  management  or  content  management.  So  you  can 
manage  growth,  protect  and  recover  information,  achieve  compliance  and  business  continu¬ 
ity,  and  keep  everything  running  smoothly.  And  EMC  software  works  with  your  systems  and 
software.  Now,  and  in  the  future.  To  learn  more,  visit  www.EMC.com/software. 
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The  Man  in  the  Middle  } — 


equipment  Old  Dominion  sent  from  getting 
to  the  docks.  Luckily,  Weiler’s  guys  (he  has  a 
team  of  three)  were  ahead  of  the  game  before 
the  storm  hit.  So,  he  explains,  “We’re  ahead  of 
schedule,”  even  though,  in  light  of  the  storm, 
“we’re  behind  schedule.”  Both  laugh  before 
Weiler  moves  on  to  update  Erdner  on  the 
other  10  projects  on  his  plate,  including 
researching  new  wireless  devices  for  sales¬ 
people,  getting  contract  negotiations  under 
way  with  MCI  (“We  could  save  the  com¬ 
pany  $50,000  a  month,”  says  Erdner)  and 
upgrades  to  the  communications  network. 

The  wonder  is  not  that  Erdner  and  his 
team  don’t  fall  behind  but  that  they  keep 
moving  ahead.  In  January,  for  example,  they 
implemented  SAP  Financials  and  Fixed 
Assets,  introduced  a  more  robust  handheld 
for  their  drivers,  investigated  a  new  wireless 
device  for  the  sales  staff  and  integrated 
WSKT’s  systems  with  their  own.  In  fact,  Erd¬ 
ner  feels  he  and  his  team  are  delivering  every¬ 
thing  the  company  needs— just  not  fast 
enough.  The  new  driver  handheld,  for  exam¬ 
ple,  which  took  nine  months,  could  have  been 
delivered  in  half  that  time  if  there  had  been 
two  developers  on  the  project  instead  of  one. 

“I’d  love  to  have  more  resources,”  says  Erd¬ 
ner  wistfully,  “just  so  we  could  get  the  same 
things  done  faster.” 

So  Many  Customers, 

So  Little  Time 

Even  if  Erdner  got  a  bigger  staff,  he’d  proba¬ 
bly  be  just  as  busy.  Possibly  busier.  He  wants 
to  know  about  everything  because,  he  says,  at 
any  moment  he  could  be  asked  a  question  by 
any  one  of  his  constituents,  and  he  wants  to 


have  a  good  answer.  And  in  Erdner’s  book,  “I 
don’t  know,  but  I’ll  look  into  that  and  get  back 
to  you”  is  not  a  good  answer. 

One  of  his  most  important  constituents  is 
his  boss,  the  president  and  COO.  David  Cong- 
don  knows  his  company’s  technology.  He 
knows  how  many  AS-400s  Old  Dominion 
has  and  what  runs  on  each.  He  knows  how 
much  each  computer  costs.  That  makes  him 
a  very  tough  boss.  Congdon  is  vividly  aware 
that  OD’s  growth  was  achieved  while  spend¬ 
ing  less  than  2  percent  of  revenue  per  year  on 
IT.  And  he  doesn’t  really  care  that  the  other 
LTL  carriers  spend  more.  “[Erdner]  runs  a 
lean  shop  on  a  lean  platform,  and  he  does  a 
great  job  for  us,”  says  Congdon. 

Congdon  is  Erdner’s  most  important  cus¬ 
tomer,  but  not  his  only  one.  Although  the 
company  employs  more  than  10,000  people 
across  the  country,  just  400  of  them  are  at 
corporate  headquarters.  But  that’s  where 
most  of  the  technology  is.  Headquarters 
absolutely  depends  on  IT  systems  and  sup¬ 
port  to  get  things  done.  The  more  IT  systems 
it  gets,  the  more  it  wants.  And  the  instant 
something  goes  wrong,  the  managers  run 
right  to  Erdner  or  one  of  his  employees. 

Because  of  this  high  level  of  involvement, 
from  his  boss  to  his  users,  Erdner  says  he  has 
to  keep  himself  in  the  loop.  He  meets  with  a 
different  manager  every  morning  at  8:30  to 
get  updates  on  everything  from  the  status  of 
big  projects  to  minutiae  such  as  a  new  scan¬ 
ner  someone  wants  to  buy.  Every  Friday,  he 
meets  with  his  programming  analysts.  Today, 
the  first  Friday  of  the  month,  he  brings  his  35 
programmers  and  analysts  into  the  big,  first- 
floor  conference  room  at  9  a.m.  One  by  one, 
each  programmer  updates  Erdner  on  every 
nuance  of  the  code  he  or 
she  is  developing.  It  lasts 
a  good  hour  and  a  half. 
Erdner,  a  former  pro¬ 
grammer,  listens  intently, 
fueled  by  the  giant  glazed 
bear  claw  his  direct  report 
Burwell  brought  in  espe¬ 
cially  for  him.  (Everyone 
else  gets  bagels.)  “I’m  a 
big-picture  guy  now,”  he 
insists.  “But  I  like  to  hear 
the  details.” 


IDEA  Generators 

CIOs  rank  themselves  (and  their  IT  departments)  as  the  top 
source  of  ideas  for  business  innovation.  They  rank  CFOs  last. 


Source 


Respondents  checked  all  that  apply. 


CIO  RESEARCH 
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“He’s  very  hands  on,  and  I  don’t  blame 
him,”  says  Senior  PC  and  Networking  Man¬ 
ager  Lisa  Boles.  “If  anything  happens,  he 
doesn’t  want  to  be  the  last  to  know.”  It’s  not 
uncommon  for  detailed  IT  questions  to  get 
thrown  at  Erdner  by  company  execs  in  the 
two-hour  Old  Dominion  executive  team 
meeting  held  on  Mondays  or  by  a  business 
user  at  the  coffeemaker.  Why  is  the  wireless 
coverage  so  bad  in  Missouri?  What  happened 
to  the  website  on  Friday  at  10:30? 

“Luckily,  I  haven’t  been  surprised  by  a 
question  in  a  long  time,”  Erdner  says. 

But  that  level  of  involvement  can  take  its 
toll.  “I  get  frazzled  sometimes,”  he  admits. 

“One  of  his  weaknesses  is  that  he  just  has 
too  much  going  on,”  says  Shawn  Pope,  an 
operations  and  help  desk  manager  who  has 
worked  in  Old  Dominion’s  IT  department  for 
22  years.  “I  understand  why  he  wants  to  be 
involved  with  everything,  but  there’s  just  so 
much.  He’s  said  he’ll  work  on  it,  but  I  don’t 
think  that  it’ll  ever  change.” 

Keeping  Up  with 
theFedExes 

Although  Old  Dominion  has  more  than  dou¬ 
bled  in  size  since  Erdner  climbed  aboard  in 
1997,  it’s  still  on  the  small  side  in  comparison 
with  the  other  LTL  leaders.  That’s  why  it 
believes  it  has  to  be  smarter  and  more  inno¬ 
vative  to  compete.  And  competition  is  always 
top  of  mind  for  Erdner. 

He  begins  his  monthly  staff  meeting  with 
his  six  direct  reports  this  Friday  afternoon  by 
going  over  the  latest  data  on  operating  ratios 
(ORs),  the  leading  industry  indicator.  ORs 
reveal  how  much  a  company  spends  to  earn 
one  dollar  of  revenue.  Old  Dominion’s  has 
improved  for  the  past  13  straight  quarters,  and 
Erdner  announces  that  for  the  fourth  quarter 
of  2004,  it’s  91.4,  meaning  the  company’s 
making  nearly  nine  cents  on  every  dollar  of 
shipping.  “It’s  the  best  we’ve  ever  finished 
since  I’ve  been  here,”  he  tells  his  team.  “And 
considering  our  growth,  that’s  tremendous.” 

Central  Trucking,  a  Texas-based  carrier 
that  once  did  more  shipping  in  that  state  alone 
than  Old  Dominion  did  in  total,  came  in  at  110 
in  Q3  of  2004,  meaning  they  were  losing  a 
dime  on  every  dollar  of  revenue.  “They’re 


... 


EMC2 

where  information  lives* 


EMC®  DOCUMENTUM®  UNITES  YOUR  CONTENT  AND  YOUR  BUSINESS.  It’s  the  only  enterprise 
content  management  solution  proven  to  handle  everything  from  records  to  rich  media  with  one 
integrated  platform.  Helping  everyone  create,  deliver,  and  archive  content  effortlessly.  All  while 
enabling  compliance,  and  reducing  costs  with  a  streamlined  process.  To  learn  how  to  share  your 
ideas,  visit  www.documentum.com.  Or  call  1-800-607-9546. 
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“We’ve  acquired  six  companies  since  I've  been  here, 

and  they  all  had  fewer  IT  people  than  we’ve  had.” 

-Ken  Erdner 


in  trouble.  If  you  go  out  to  their  chat  rooms 
on  the  Web,  their  employees  are  saying,  We 
really  hope  Old  Dominion  buys  us,”  Erd¬ 
ner  says  to  a  round  of  laughter  in  the  con¬ 
ference  room.  But  he  goes  on  to  note  that 
three  competitors  are  doing  better:  “ABF 
rebounded  nicely  in  Q4  to  90.5.  And  Con- 
Way  is...oh,  wait. ..we  beat  Con-Way,”  he 
announces.  “Yahoo!” 

There  are  several  Goliaths  in  the  LTL 
business.  Most  notably,  there’s  FedEx 
(although  LTL  is  only  about  11  percent  of  its 
business),  which  has  nearly  5,000  IT  work¬ 
ers  on  staff.  Other  Fortune  500  competitors 
include  Con-Way,  with  287  IT  employees; 
Yellow  Freight,  with  361;  and  ABF,  with  200 
(according  to  the  most  recent  available  fig¬ 
ures).  “The  competition?”  says  Erdner.  “Oh 
yeah,  their  IT  staffs  are  huge.'’ 

To  compete,  Erdner  must  stay  up  on  the 
latest  technology.  “I  just  can’t  find  the  time,” 
says  Networking  Manager  Boles.  “He’s  always 
throwing  articles  into  my  inbox  with  a  note: 
‘Hey,  maybe  there’s  something  here  for  you.’” 

But  keeping  up  with  technology  is  only  a 
start.  Erdner  must  also  make  sure  his  staff 
innovates.  Eighty  percent  of  CIOs  who 
responded  to  our  survey  on  IT-enabled  inno¬ 
vation  (a  supplement  to  our  “State  of  the  CIO” 
research)  cited  the  IT  department  as  a  source 
for  business  innovations,  over  business  unit 
leaders  or  their  company  CEO.  And  that’s  the 


case  at  Old  Dominion.  “Erdner  is  not  your 
typical  IT  person,”  says  Vice  President  of 
Field  Services  Terry  Hutchens.  “He’ll  chal¬ 
lenge  you  and  say,  I’ve  got  a  resource.  What 
can  this  person  be  working  on  for  you?  Or, 
I’ve  got  an  idea  for  how  we  can  make  you 
more  efficient.” 


Time  to  Blue-Sky 

New  ideas  tend  to  come  largely  from  two 
yearly  offsites  and  the  monthly  Thursday 
morning  meeting  Erdner  has  with  his  man¬ 
agement  staff.  In  contrast  to  the  analysts  and 
programmers’  meetings,  this  one  is  pure 
blue-sky.  Today,  Erdner  says  he’s  divided  Old 
Dominion’s  revenue,  and  that  of  its  top  four 
competitors,  by  the  number  of  IT  employees, 
to  create  a  new  metric:  revenue -to-IT- 
employee.  Currently,  the  big  guys  are  all 
between  about  $5  million  and  $7  million  of 
revenue  per  IT  employee.  Old  Dominion  is 
making  $10  million  per  IT  employee.  Look¬ 
ing  10  years  out,  Erdner  has  created  a  plan 
for  hiring  42  more  IT  staffers  (In  areas  from 


Insight  on  Innovation 


Are  you  also  trying  to  target  your  innovation 
budget?  Get  some  ideas  and  insights  from  the 
full  results  of  the  I.T. -ENABLED  INNOVATION 
SURVEY  at  www2.cio.com/research 
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networking  to  wireless  to  new  technology) 
while  increasing  OD’s  revenue-to-IT- 
employee  figure  to  $25  million.  His  six  direct 
reports  don’t  immediately  comment  on  the 
fact  that  his  plan  is  predicated  on  Old 
Dominion  more  than  doubling  its  revenue 
per  IT  employee  over  that  same  time.  Instead, 
they  tease  him  about  why  Boles  (who  Erdner 
refers  to  as  his  “bestest  buddy”)  and  Senior 
Applications  Manager  Barry  Graver  are  slot¬ 
ted  to  get  the  most  help  in  2015. 

Then,  a  discussion  on  the  best  wireless 
devices  for  salespeople  In  the  field  leads  to  the 
thought  that  maybe  they  need  something  else 
entirely.  The  sales  application  they  use  most  is 
way  too  complicated  to  access  on  the  Palm 
Treo  650’s  tiny  keyboard.  Wayne  Capwell, 
Erdner’s  e-commerce  manager,  had  just  been 
talking  about  his  research  into  Web  services 
(in  the  hope  that  Erdner  would  give  him  the 
green  light  to  invest  $50,000  in  a  discount 
version  of  IBM’s  WebSphere  development 
tool).  Could  we  create  a  Web  service  that 
would  enable  the  salespeople  to  query  the  sys¬ 
tem  from  the  road  through  an  e-mail  and  a 
simple  subject  line?  Graver  wonders  aloud. 
Maybe  they  could  type  in  “customer  info”  and 
the  customer  number  and  the  app  would 
retrieve  the  information  and  send  it  back  to 
the  salesperson  via  e-mail. 

“If  we  do  something  with  Web  services,” 
Erdner  interjects,  “are  we  going  to  have  to 
add  another  person?” 

“Yeah,”  says  Graver.  ‘And  while  we’re  on 
the  subject,  can  we  get  back  to  your  numbers 
for  2015?  Aren’t  we  going  in  the  wrong  direc¬ 
tion  with  this  revenue-per-IT-employee  fig¬ 
ure?”  Erdner  could  double  his  staff  over  the 
next  10  years  and  still  have  a  better  revenue- 
to-IT  ratio  than  the  competition— a  more 
attractive  proposition  to  his  direct  reports. 

A  few  of  the  ideas  that  have  emerged  from 
these  sessions  have  proved  significant.  Most 
never  turn  into  anything.  They  may  be  too 
costly,  or  they  may  deliver  too  minimal  a 
return.  But  when  you’re  running  as  fast  as 
you  can  just  to  keep  up,  you  can  never  stop. 

Just  ask  Ken  Erdner. 

If  you  can  catch  him.  Ena 


Senior  Editor  Stephanie  Overby  can  be  reached 
at  soverby@cio.com . 
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Fr:  managing  your  entire  e-mail  system 


To:  managing  it  while  you  check  your  voice  mail 
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legato 


EMC  LEGATO"  HELPS  YOU  MEET  COMPLIANCE  DEMANDS  WHILE  SAVING  TIME  AND 
MONEY  WITH  A  SMARTER  WAY  TO  MANAGE  E-MAIL.  Now  you  can  handle  everything  from 
indexing  and  archiving  to  backup  and  restore,  with  one  solution.  A  solution  built  to  lower  storage 
costs,  reduce  recovery  time,  and  enable  compliance  with  advanced  search  capabilities.  It’s  wh 
you  need  to  perform  better,  reduce  expenses,  and  go  home  on  time.  Finally.  To  leamjnerefvTsit" 
www.EMC.com/legato.  Or  call  1-888-853-4286. 
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The  Public  Servant  } 

Robert  Taylor, 

CIO,  Fulton  County,  Ga. 


Where  There’s  a  Person,  There’s  a 


V 


Like  it  or  not: 

When  you’re  a 
public-sector  CIO, 
the  public  will  have 
a  lotto  say  about 
everything  you  do 

BY  ALLAN  HOLMES 


At  6:45  a.m.,  it’s  still  dark  outside  Robert  Taylor’s  comer  office  in 

the  Government  Center  building  on  the  outskirts  of  downtown  Atlanta.  Taylor,  CIO 
for  Fulton  County,  Ga.,  is  hunched  over  his  keyboard,  scrolling  through  the 
e-mails  that  he  received  yesterday  and  was  unable  to  answer  from  home  on  his 
BlackBerry— one  of  the  last  things  he  does  before  going  to  bed  every  night. 

Taylor  finishes,  pushes  the  keyboard  away  and  walks  over  to  a  conference  table 
where  Terry  Gates,  the  county’s  CTO,  is  waiting  for  him. 

“OK,  let’s  get  started,”  Taylor  says.  “There  seems  to  be  an  issue  at  the  library?” 

For  the  next  hour  and  a  half,  Taylor  and  Gates,  who  Taylor  hired  in  November 
from  Atlanta-based  Home  Depot  to  manage  day-to-day  technology  operations,  dis¬ 
cuss  nearly  a  dozen  issues— including  switching  the  county  library  PCs  off  the  old 
and  insecure  state  network  to  the  more  secure  county  network,  service-level  agree¬ 
ments  for  the  county’s  help  desk,  an  inventory 
„  ,  TT^  . ,  The  events  in  this  story  occurred 

ot  the  computer  room,  voice  over  IP,  videocon-  ^  ^  2005 

ferencing,  ways  to  satisfy  the  county  commis¬ 
sioners’  desire  to  increase  investments  in  minority  organizations,  the  need  to 
expand  a  telephone  system  at  a  nearby  county  building,  and  a  calendar  for  IT 
maintenance  and  upgrades  that  all  county  employees  can  view. 

Despite  the  rainbow  of  tasks  and  challenges  that  come  up,  the  discussion  turns— 


AGENDA  2005 


::  Convince  the  county  that  IT  ::  Get  funds  to  upgrade  the  ::  Centralize  IT  for  the  county 

is  core  to  good  governing  prisoner-tracking  information  and  fend  off  attempts  by 

system  departments  to  do  their  own  IT 
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as  most  discussions  in  Taylor’s  office  inevi¬ 
tably  do— into  a  conversation  about  staff: 

“Is  he  a  good  candidate  for  a  project  man¬ 
ager?” 

“I’m  concerned  he  takes  over  and  pushes 
people  out  of  the  way.  ” 

“He’s  spread  too  thin.  ” 

“He’s  only  coasting  and  waiting  to  retire.  ” 
Since  becoming  CIO  in  2000,  Taylor  has 
implemented  the  county’s  first  IT  security 
plan,  updated  and  upgraded  the  county’s 
hardware  and  software,  and  perhaps  most 
important,  secured  a  seat  at  the  county 
management  table— the  first  Fulton  County 
CIO  to  do  so.  But  he  constantly  worries 
about  the  many  people  on  his  staff  who  lack 
project  management  and  technology  skills 
and  suffer  from  the  bureaucratic  lethargy 
(endemic  to  government)  that  discourages 
innovation.  He  also  worries  about  his  staff’s 
age:  A  quarter  of  his  145  people  will  be  eli¬ 
gible  for  retirement  in  the  next  two  years. 
And  then,  there’s  money.  Right  now,  Taylor 
has  10  unfilled  positions  because  a  num¬ 
ber  of  staff  members  retired  at  the  end  of 
2004,  and  until  recently,  he’d  been  operat¬ 
ing  under  a  hiring  freeze.  Still,  even  with 
the  freeze  lifted,  Taylor  knows  that  finding 
the  talent  he  needs  will  be  difficult. 


The  Public- Sector  Squeeze 

Taylor’s  situation  is  not  atypical.  According 
to  CIO’s  “The  State  of  the  CIO  2004”  survey 
(' www.cio.com/04010S ),  out  of  11  possible 
choices,  government  CIOs  named  “lack  of 
key  technical  skill  sets  within  IT”  as  one  of 
their  five  biggest  barriers  to  being  effective. 
Not  so  for  Taylor’s  private-sector  counter¬ 
parts,  who  ranked  a  lack  of  IT  skills  as  the 
eighth  biggest  barrier  to  effectiveness. 

As  is  the  case  in  the  private  sector,  Taylor 
faces  a  tight  budget  (number  two  on  the  list 
of  barriers  for  both  private-  and  public- 
sector  CIOs).  Taylor’s  budget  for  2004  was 
$24  million,  a  slight  increase  from  the 
$21  million  he  had  in  2000,  the  year  he  was 
hired.  But  most  of  that  increase  came  from  a 
2004  reorganization  that  transferred  30 
positions  and  related  contracts  to  his  depart¬ 
ment.  The  lines  of  business  Taylor  is  respon¬ 
sible  for  increased  from  20  to  42.  After  all 
that  figures  in,  Taylor  argues  that  his  budget 
actually  has  decreased  over  that  time. 

Despite  these  hurdles,  Taylor  has  set  some 
lofty  goals  for  his  department.  He  wants 
Fulton  County  to  be  one  of  the  leading  IT- 
managed  counties  in  the  nation.  And  from 
the  looks  of  the  awards  from  trade  magazines 
such  as  Governing  and  Computerworld  (a  sister 
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EXPERIENCE:  MBA,  University  of 
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GeoLogistics  International,  1998-2000; 
director  of  IT,  provider  systems, 
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PERFORMANCE  MEASURES: 

•  Responsiveness  to  Board  of  Commis¬ 
sioners’  requests  for  IT  projects  and 
information 

•  Delivery  of  ROI  for  majortechnology 
initiatives 

•  Efficiency  of  IT  operations 

•  Getting  the  best  deal  from  vendors 
while  adheringto  purchasing  laws 

•  Delivery  of  IT  systems  on  time  and 
within  budget 

•  Satisfaction  of  customer  expectations 

company  to  CIO’s  publisher)  that  sit  on  his 
office  shelves,  it  seems  he’s  had  a  measure  of 
success.  But  to  do  so,  he  says,  he’s  had  to 
“bang  the  hell  out  of  vendors  to  squeeze 
every  dollar  out  of  contracts,”  force  a  cultural 
change  within  his  IT  shop,  and  convince 
elected  officials  and  department  heads  that 
IT  is  core  to  the  job  of  running  a  government. 

“This  job  is  like  walking  a  tightrope,  car¬ 
rying  a  balance  bar  with  a  deadweight  on  one 
side  and  a  live  animal  on  the  other  and  know¬ 
ing  you  have  to  make  it  across  the  canyon 
with  no  net,”  Taylor  says.  “But  if  you  make  it 
to  the  other  side,  you  know  it’ll  be  worth  it.” 

A  Personnel  Problem 

Taylor  wraps  up  his  meeting  with  Gates  at 
8:30.  He’s  already  behind  schedule,  and  he 
doesn’t  like  it.  Two  of  his  top  managers— 
Sandra  Lawton,  deputy  director  of  applica- 


72 


APRIL  1,  2005  |  www.cio.com 


Stranded 


Supported 


DB2  WON’T  ABANDON  YOU. 

Perhaps  you’ve  heard:  Oracle  desupported  Oracle 
Database  8i  last  year.  Meaning  potential  headaches, 
higher  cost  or  a  complete  migration  to  current  versions 
of  Oracle.  Fortunately,  IBM  offers  ongoing,  around-the- 
clock  service  and  support  for  DB2. 

But  that’s  not  all.  A  Solitaire  study  has  found  that,  on 
average,  Oracle  Database  requires  25%  more  time  to 
manage  than  DB2.'  That’s  big. 

And  an  ITG  study  showed  overall  costs  for  Oracle  Database 
up  to  four  times  higher  than  DB2.2  The  Transaction  Process¬ 
ing  Performance  Council  results  show  that  DB2  and 
eServer'"  p5-595  are  more  than  twice  as  scalable  as  Oracle 
Real  Application  Clusters,  making  them  the  overwhelming 
performance  and  scalability  leader  for  TPC-C.3  That’s  big,  too. 


No  wonder  DB2  is  regarded  as  the  leading  database  built 
on  and  optimized  for  Linux?  UNIX®  and  Windows?  Like 
other  IBM  database  engine  products  such  as  Informix® 
and  Cloudscape’,"  DB2  is  part  of  an  innovative  family  of 
information  management  middleware  that  integrates,  and 
can  actually  add  insight  to  your  data. 

It’s  also  built  to  take  full  advantage  of  your  existing 
heterogeneous  and  open  environments,  and  is  built  to 
enable  true  grid  computing. 

Why  not  move  up  to  middleware  that  makes  sense?  Now 
you  can  get  IBM  DB2  Universal  Database  or  Informix 
by  taking  advantage  of  our  extremely  compelling  trade- 
up  program.  Visit  ibm.com/db2/swap  today  to  find  out  if 
you  qualify. 


DEMAND  BUSINESS 


IBM,  the  IBM  logo,  DB2,  eServer,  Informix,  Cloudscape  and  the  On  Demand  logo  are  trademarks  or  registered  trademarks  of  International  Business  Machines 
Corporation  in  the  United  States  and  other  countries.  Linux  is  a  registered  trademark  of  Linus  Torvalds.  Microsoft  and  Windows  are  registered  trademarks  of  Microsoft 
Corporation  in  the  United  States  and/or  other  countries.  UNIX  is  a  registered  trademark  of  The  Open  Group  in  the  United  States  and/or  other  countries.  Other 
company,  product  and  service  names  may  be  trademarks  or  service  marks  of  others.  ©2005  IBM  Corporation.  All  rights  reserved.  ’“DB2  Performance  on 
IBM  Server'  pSeries  and  xSeries,”  Solitaire  Interglobal  Ltd.,  2003:  based  on  Oracle  Database  9i.  "IBM  Solutions  for  PeopleSoft  Deployment  in  Mid-sized  Businesses 
Quantifying  the  New  Cost/Benefit  Equation,”  July  2003.  International  Technology  Group,  Los  Altos,  California.  3AII  referenced  results  are  current  as  of  12/14/04 
DB2  UDB  v8.2  on  IBM  eServer  p5  595  (64-way  POWER5  1.9  GHz)  and  AIX  5.3L:  3,210,540  tpmC  @  S5.19/tpmC  available:  May  15,  2005,  vs.  Oracle  RAC  lOg  on 
HP  Integrity  rx5670  Cluster  64P  (16  x  4-way  Intel  Itanium2  6M  1.5GHz):  1,184,893  tpmC  @  $5.52/tpmC  available:  April  30,  2004:  TPC  Benchmark,  TPC-C,  tpmC 
are  trademarks  of  the  Transaction  Processing  Performance  Council.  For  further  TPC-related  information,  please  see  http://www.tpc.org/ 


{  STATE  OF  THE  Clffi 


The  Public  Servant  } — 


tions,  and  Richard  Garrett,  assistant  director 
for  applications— arrive  to  discuss  an  appeal 
filed  by  an  employee  who  was  fired  last 
August  for  a  performance-related  matter. 
The  former  employee  claims  the  firing  was 
discriminatory  on  several  grounds,  includ¬ 
ing  religion  and  national  origin.  Given  the 
statements  of  his  managers,  Taylor  is  reluc¬ 
tant  to  hire  the  individual  back. 

Taylor  and  the  managers  discuss  the  for¬ 
mer  employee’s  charges  relating  to  current 


rules  for  time  sheets,  attendance  and  access  to 
various  secured  areas  within  the  department. 
The  discussion  centers  on  questions  that  the 
county’s  Office  of  Equal  Employment  Oppor¬ 
tunity  asked  in  a  memo  about  attendance, 
work  assignments  and  accommodations  for 
religious  practices.  Taylor’s  managers  say 
accommodations  were  made  to  allow  the 
employee  to  wear  traditional  clothing  and  to 
allow  time  off  in  the  early  afternoon  on  Fri¬ 
days  to  observe  his  religion. 

Micromanaging  is  what  Taylor 
calls  this  stuff,  and  he  says  it  takes 
away  from  what  he  would  like  to 
do— strategic  planning.  “These  are 
the  kinds  of  issues  you  have  to  deal 
with  in  government,”  he  says  on 
his  way  to  the  10th  floor  to  meet 
with  the  county  manager.  “I  have  a 
lot  of  issues  like  these.  If  I  didn’t 
have  to  deal  with  all  this,  I  would 
be  twice  as  productive.” 

(A  few  weeks  later,  the  county 
Personnel  Board  rules  that  there  is 
no  evidence  of  discrimination  but 
votes  to  reinstate  the  employee, 
suggesting  that  termination  was 
too  harsh  a  disciplinary  measure.) 


PUBLIC  VS.  PRIVATE: 

Conflicting  Priorities 

Government  CIOs  rank  the  pace  of  technology 
change  and  the  lack  of  key  technical  skill  sets  within 
IT  among  their  biggest  hurdles.  Yet  they  spend  rela¬ 
tively  less  time  than  their  private-sector  peers  on 
staff  development  and  more  time  fighting  fires. 

On  what  do  you  spend  the  most  time? 


Strategic  planning 


Government  CIOs 

66%] 

Private  Sector 

58%HB 

Interacting  with  other  CXOs  and  business  executives 


64%| 

71%| 


Managing  crises/putting  out  fires 

62% 

46% 

Leading  projects 


59%i 


Designing/optimizing  business  processes 


54%j 

44%aai 


Interacting  with  IT  vendors/outsourcers/service  providers 


54% 

54% 


Hiring,  developing  and  managing  the  IT  staff 


49  %j 
48%| 


Learning  about  technologies/making  strategic  systems  decisions 


46%| 

53% 


Budgeting 


Interacting  with  outside  business  partners/suppliers/customers 


Respondents  picked  top  five. 
SOURCE:  "The  State  of  the  CIO  2004" 
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The  Boss  and 
the  Budget 

County  Manager  Tom  Andrews 
has  called  a  meeting  of  his  direct 
reports  to  discuss  additions  to  the 
annual  budget.  Taylor  reports  to 
Andrews,  who  hired  him  in  2000 
from  the  Georgia  Department  of 
Administrative  Services,  Technol¬ 
ogy  Services  division.  Andrews’ 
choice  was  a  signal  that  the  county 
was  taking  IT  seriously.  The  posi¬ 
tion’s  title  was  changed  from 
director  of  technology  to  CIO,  and 
Taylor  was  the  first  IT  chief  since 
the  position  was  established  in 
1993  to  have  had  both  academic 
and  technological  training. 

The  directors  of  health,  public 
works,  finance,  budget  and  others 
attend  the  meeting.  Only  Taylor 
and  Andrews  wear  suits.  Taylor 
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has  on  a  charcoal  pinstriped  three-piece  suit, 
a  white  shirt  with  French  cuffs,  gold  and 
turquoise  mother-of-pearl  cuff  links  and  a 
red  silk  tie  with  a  quiet  blue  design.  Taylor 
admits  to  being  a  clotheshorse,  with  33  suits 
and  15  pairs  of  shoes  in  his  closet. 

He  also  says  he  dresses  this  way  because 
he  never  knows  when  he’s  going  to  run  into 
a  judge,  the  secretary  of  state,  a  reporter  or 
the  governor.  Furthermore,  he  believes  his 
suits  help  him  project  an  image  of  the  IT 
department  as  something  more  than  just  a 
programming  shop,  which  is  how  it  was 
viewed  before  he  arrived.  What  IT  does,  he 
says,  is  central  to  the  county’s  mission  and 
directly  serves  county  residents.  “I  need  to 
always  be  in  position  to  project  a  positive 
image,”  Taylor  says.  “Of  course,  to  show  I 
haven’t  completely  sold  out  my  south  Geor¬ 
gia,  farm-boy  heritage,  I  push  the  envelope 
with  long  hair  and  a  goatee.” 

Taylor  listens  to  other  department  heads 
discuss  a  list  of  add-ons  to  the  2005  budget, 
which  the  commissioners  will  consider  the 
following  week.  This,  Taylor  believes,  will  be 
his  chance  to  ask  for  $500,000  to  modernize 
a  jail  management  system  to  track  the  inmate 
population,  which  all  three  justice  depart¬ 
ments— the  superior  court,  the  state  court  and 
the  district  attorney’s  office— could  use  to 
access  prisoner  information  in  real-time.  The 
old  system  was  built  in  1994  and  had  its  only 
refresh  in  the  late  1990s  to  prepare  for  Y2K.  It 
is  four  versions  behind  and  still  runs  on  main¬ 
frame  flat  files.  “I’ve  begged,  pleaded  and 
waved  all  sorts  of  flags,  but  I  haven’t  been  able 
to  get  the  funds  to  modernize  it,”  Taylor  says 
before  the  meeting. 

The  present  system  is  ancient  green- 
screen  tech  and  requires  users  to  move 
through  more  than  a  dozen  screens  to  input 
data.  The  upgrade  also  will  update  the  work- 
flow  application,  called  the  Justice  Datalink, 
that  connects  the  prison  system  to  the  supe¬ 
rior  court,  state  court  and  DA’s  office. 

The  meeting  is  winding  down,  but  the 
county  budget  director  has  not  mentioned  the 
prison  project.  It’s  not  on  the  list.  Taylor  asks 
Andrews  if  that  means  it  isn’t  considered 
important.  “If  it  doesn’t  come  up,  my  guess  is 
that  it  won’t  be  added,”  Andrews  tells  Taylor. 

On  the  way  back  to  his  office,  Taylor  is  quiet. 
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His  Pal,  the  Vendor 

After  the  budget  meeting,  Taylor  has  a  sit- 
down  with  Kwang  Kim,  president  of  Consil¬ 
ium  Consulting,  which  manages  the  county’s 
databases— including  Oracle,  Unix  and  e-mail. 

Before  the  meeting  starts,  Taylor  explains 
that  he  has  no  certified  database  administra¬ 
tors  on  staff.  The  starting  annual  salary  for  a 
database  administrator  at  the  county  tops  out 
at  $65,000,  but  Taylor  says  he  would  likely 
have  to  pay  more  than  $100,000  for  a  certi¬ 
fied  database  administrator.  For  years,  Taylor 
has  asked  the  Board  of  Commissioners  to 
fund  three  positions  to  support  database 
administration.  He’s  been  turned  down  every 


arrangement.  His  systems  are  now  more 
reliable,  and  if  there’s  a  problem,  Taylor  says 
his  calls  to  Consilium  are  returned  within 
the  hour,  24/7. 

Still,  it  hasn’t  been  a  completely  smooth 
transition.  An  employee  filed  a  grievance  with 
the  county’s  Equal  Employment  Opportunity 
office  after  the  contract  was  awarded,  claiming 
he  had  the  skills  to  manage  the  databases.  Tay¬ 
lor  disagreed,  adding  that  he  had  neither  the 
time  nor  money  to  train  someone.  The  EEO 
office  ruled  that  the  outsourcing  move  was  not 
discriminatory  and  that  Taylor,  indeed,  did 
not  have  the  appropriate  skills  on  staff. 

The  meeting  with  Consilium  goes  well, 


For  the  duration  of  the  meeting,  Taylor  has 
no  headaches,  no  complaints  to  attend  to,  no 
budget  decisions  to  make. 

This  quiet  time  doesn’t  last  long. 

The  Project  Demo  Disaster 

Taylor  crosses  the  Government  Center  build¬ 
ing  to  attend  a  meeting  of  the  Criminal  Justice 
Information  Policy  board,  a  group  that  meets 
on  IT  issues  affecting  the  superior  court,  state 
court  and  DA’s  office.  Taylor  arranged  for 
Tiburon,  the  maker  of  the  prison  information 
system  software,  to  demonstrate  the  upgrade. 
Taylor  wants  everyone  to  understand  what’s 


“I’ve  had  them  follow  me  into  the  bathroom  and  talk  to  me  about 
something  that’s  worrying  them  while  I’m  standing  at  the  urinal.” 

-Robert  Taylor 


time.  That,  and  his  inability  to  find  people 
with  the  requisite  skills,  led  to  his  decision  to 
outsource  the  work.  Taylor  outsourced  the 
county’s  website  hosting  last  year  and  tech¬ 
nical  services  in  2003. 

About  2  dozen  companies  submitted  bids 
for  the  database  management  contract,  and 
Taylor  chose  Consilium,  which  bid  $5.8  mil¬ 
lion  over  five  years  to  manage  20  databases, 
and  fixed  another  price  to  accommodate 
growth.  Taylor  has  been  pleased  with  the 


and  Taylor  likes  what  he  hears.  They  discuss 
the  status  of  databases  related  to  specific 
applications,  such  as  justice.  The  county’s 
Oracle  license  was  scheduled  to  expire  today, 
but  Kim  reports  he  received  an  e-mail  con¬ 
firming  that  the  license  has  been  extended 
for  one  month  with  no  out-of-pocket  money 
from  Taylor.  “That’s  the  kind  of  service 
Kwang  can  provide  because  of  his  connec¬ 
tions,”  Taylor  says.  “That  might  not  have  hap¬ 
pened  if  this  was  in-house.” 


being  proposed.  More  than  30  people  attend. 

On  the  way  into  the  meeting,  someone 
from  the  public  defender’s  office  pulls  Taylor 
aside  to  ask  what  to  do  about  an  employee 
who  is  violating  e-mail  policy.  Taylor  says 
he’ll  get  back  to  him  after  the  meeting.  “This 
happens  all  the  time,”  Taylor  says.  “I’ve  had 
them  follow  me  into  the  bathroom  and  talk  to 
me  about  something  that’s  worrying  them 
while  I’m  standing  at  the  urinal.” 

Most  people  watching  the  demonstration 
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are  open  to  the  idea  of  a  new  Tiburon  jail 
system.  But  the  DA’s  office  is  concerned  that 
it  won’t  provide  adequate  confidentiality 
and  that  Tiburon  hasn’t  had  a  good  track 
record  in  maintaining  the  current  system, 
which  frequently  crashes.  The  DA’s  office 
wants  to  spend  $7  million  on  its  own  sys¬ 
tem,  which  would  set  Taylor  back  in  his 
strategy  to  centralize  IT  for  the  county.  The 
DA’s  office  has  its  own  IT  staff— a  small 
one— that  does  some  basic  applications  sup¬ 
port  and  desktop  and  network  maintenance, 
but  Taylor’s  shop  would  be  accountable  for 
the  provisioning  and  management  of  the 
DA’s  system. 

On  a  giant  whiteboard,  Tiburon  represen¬ 
tatives  project  three  screen  shots,  side  by  side, 
which  represent  the  three  judicial  depart¬ 
ments.  Taylor’s  demo  is  supposed  to  show 
how  information  entered  into  one  database 
will  immediately  show  up  on  all  the  others. 
But  the  projector  freezes  several  times  and 
data  keyed  into  one  page  does  not  show  up  on 
the  others. 


Get  the  Whole  Report 


Our  2004-2005  STATE  OF  THE  CIO  study  finds 
thatyourtechnology  priorities  for  2005  include 
integrating  systems  as  well  as  redesigning  and 
rationalizing  the  IT  infrastructure  and  external 
customer  service— public  or  private.  Read  all 
about  it,  available  in  hard  copy  or  PDF.  Go  to 
www.theciostore.com. 
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Taylor  is  not  pleased,  and  he  worries  that 
the  Tiburon  execs  have  not  stressed  how  they 
will  partner  with  the  county  on  the  upgrade. 
After  the  meeting,  Taylor  talks  to  Major  Skip 
Platt  from  the  sheriff’s  office,  who  assures 
Taylor  that  he  supports  the  upgrade.  Superior 
Court  Judge  Doris  Downs,  once  skeptical 
about  the  upgrade,  pulls  Taylor  aside  to  say 
she’s  pleased  with  what  she  saw.  “Maybe  it 
wasn’t  as  bad  as  I  thought,”  Taylor  says. 

Another  People  Problem 

As  soon  as  Taylor  is  back  behind  his  desk, 
Russell  Mobley,  assistant  director  for  admin¬ 
istration,  comes  in  carrying  a  piece  of  paper. 
“We  have  an  issue  here,”  Mobley  says.  “Some¬ 
one  called  [County  Board]  Commissioner 
[Bill]  Edwards’  office,  complaining  that  he 
applied  for  the  CTO  job  and  never  got  a  call 
for  an  interview.  They  want  an  explanation.” 
Taylor  takes  the  resume  from  Mobley  and 
scans  it.  “Come  on,”  he  says,  pulling  on  his 
suit  jacket  and  heading  for  the  elevator  and 
the  commissioner’s  tenth  floor  office.  His  next 
meeting  is  going  to  have  to  wait. 

Complaints  like  this  are  not  unusual. 
Many  of  Taylor’s  staffing  and  hiring  deci¬ 
sions,  especially  for  some  of  the  top  paying 
positions,  are  questioned  because  the  open¬ 
ings  are  publicly  posted.  And  Taylor  must 
answer  to  the  commissioners. 

In  Edwards’  office,  Taylor  explains  to  two 


of  the  commissioner’s  assistants  that  he 
received  145  applications  for  the  position  and 
interviewed  the  top  12.  The  person  com¬ 
plaining  lacked  sufficient  management  expe¬ 
rience  (he  had  supervised  only  four  people 
in  the  past)  and  had  no  experience  as  a  CTO. 
Therefore,  he  didn’t  make  the  first  cut. 

The  assistants  are  satisfied,  thank  Taylor, 
and  Taylor  and  Mobley  head  back  down  to 
the  ninth  floor. 

Sometimes,  Things 
WorkOut 

Taylor  sends  an  e-mail  to  me.  “The  [Board  of 
Commissioners]  meeting  on  the  budget  is 
today.  I  just  received  the  funding  for  upgrad¬ 
ing  the  jail.  Victory!!” 

Taylor  got  the  $500,000  to  upgrade  the 
jail  management  system  as  well  as  $200,000 
for  a  new  Unix-based  server  on  which  to  run 
it.  The  sheriff’s  office  threw  its  weight  behind 
the  proposal  and  helped  argue  that  the 
upgrade  would  be  cheaper  than  a  new  system 
and  still  meet  everyone’s  needs. 

“This  really  makes  it  worthwhile  when 
you  look  back  across  the  canyon  to  see  how 
far  you’ve  come  and  how  far  down  the  canyon 
floor  actually  was,”  Taylor  says.  HEl 


Washington  Bureau  Chief  Allan  Holmes  writes 
frequently  on  public-sector  IT.  He  can  be  reached 
at  aholmes@cio.com. 
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THE  IDEAL  and 


THE  REA 


What  makes  a  good  CIO  today?  What  should  a  CIO  be  responsible  for? 

What  are  the  best  traits  for  the  job?  CIO  has  been  posing  these  fundamental  questions  for  nearly 
two  decades.  The  answers  have  changed  over  time,  but  they’ve  never  been  more  critical  than  they 
are  today.  The  CIO  position  is  undergoing  a  bifurcation,  with  a  growing  gap  between  the  strategic 
leaders  who  leverage  IT  to  drive  the  business,  and  the  stewards  of  data  and  systems  whose  jpurpose 
largely  is  to  cost-manage  what  is  perceived  as  a  commodity.  Because  all  types  of  CIOs  turn  to  this 
publication  to  learn  from  their  peers,  the  editors  must  respect  a  variety  of  needs.  But  if  you  ask  us  what 
the  CIO  ought  to  be,  we  have  one  answer:  a  strategic  business  leader. 

Thqldeal  CIO  position-— the  one  that  will  bring  the  most  benefit  to  the  most  companies— is  defined 
by  a  finite  set  of  responsibilities,  accountabilities  and  essential  skills.  We’ve  collected  these  job  ele¬ 
ments  into  a  simple,  digestible  document,  formatted  as  a  CIO  “job  spec”  from  a  hypothetical  com¬ 
pany  that  understands  the  value  of  IT.  The  spec  was  developed  by  drawing  upon  data  from  many 
studies  of  the  role,  and  from  extensive  input  from  CIOs  and  executive  recruiters.  It  was  refined  and 
finalized  jointly  with  the  CIO  Executive  Council,  a  professional  association  of  CIOs  founded  by  CIO. 

It’s  one  thing  to  know  the  ideal;  it’s  another  to  see  where  you  stand  against  it.  Our  self-assessment 
test  lets  you  see  how  the  role  in  your  company  slacks  up  against  our  ideal.  (For  the  interactive  ver¬ 
sion  of  the  quiz  and  related  articles,  go  to  the  online  version  of  this  story  or  umv.cio.com/04010S.)  We 
hope  that  IT  leaders,  and  the  executives  who  hire  them  and  shape  company  attitudes  toward  IT,  will 
use  both  the  specification  and  the  test  as  guides  for  crafting,  assessing  and  refining  the  CIO  role. 
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1.  To  whom  do  you  report? 

□  CEO  (7  points) 

□  COO  (5  pts.)  _ 

□  Operationally  oriente 
CFO  (4  pts.) 

□  Financially  oriented  CFO 
(0  pts.) 

□  Corporate  CIO  (2  pts.) 

□  Other  (0  pts.) 


2.  What  is  your  functional  title. 

□  Executive  vice  president 

(5  points)  _ 

□  Senior  vice  president  (4  pts.) 

□  Vice  president  (3  pts.) 

□  Director  (0  pts.) 

□  CIO  only— no  functional  title 

(3  pts.) 

□  Other  (Opts.) 


3.  Are  you  a  member  of  the  executive 
committee? 

□  i  am  a  voting  member. 

(10  points) 

□  I  have  no  voting  power,  but 
attend  meetings.  (7  pts.) 

□  I  am  not  present  at  executive 
committee  meetings.  (0  pts. 


6.  How  is  IT  governance 

accomplished? 

□  A  strategic  governance  com 
tee,  which  includes  key  busi¬ 
ness  leaders,  determines  IT 
investment  priorities. 

(10  points) 

□  I  chair  a  strategic  governance 
committee  that  includes  key 

business  leaders.  (15  pts.) 

D  There  is  no  governance  commit¬ 
tee;  I  mandate  governance 
arrangements.  (2  pts.) 

□  There  is  no  governance  commit¬ 
tee;  I  make  governance  deci¬ 
sions  collaboratively  with 
business  leaders.  (8  pts.) 

□  There  is  no  governance  commit¬ 
tee;  governance  arrangements 

vary  by  business  unit.  (0  pts.) 

□  Governance  arrangements  aie 

widely  understood  by  business- 

side  managers  throughout  the 
organization.  (10  pts.) 


4.  What  is  the  board  of  directors 
involvement  with  IT? 

□  There  is  a  standing  board 

committee  on  IT.  (10  points) 

□  IT  reports  regularly  to  the 
board.  (20  pts.) 

□  IT  reports  occasionally  to  the 

board.  (10  pts.) 

□  IT  has  no  involvement  with  the 
board.  (0  pts.) 


5.  Who  are  your  main  constituents? 

O  I  work  closely  with  other  CXO  . 

(4  points) 

D  i  work  closely  with  business 

leaders.  (4  pts.)  . 

□  I  focus  on  my  IT  staff.  (0  pts.) 


and  inte- 


tions  and  standards), 

gration  at  both  the  enterprise 

and  business-unit  levels.  (7  pts.) 

□  I  hold  authority  and  accounta¬ 
bility  for  IT  architecture,  infra¬ 
structure  and  integration  at  the 
enterprise  level,  while  business 
units  handle  their  own  arrange¬ 
ments.  (3  pts.) 

□  There  is  no  oversight  or  guiding 
logic  to  my  organization  s  IT 
architecture,  infrastructure  or 
integration.  (0  pts.) 

O  I  have  an  architectural  knowl¬ 
edge  of  applications  at  the  enter- 

prise  and  business-unit  levels. 

(3  pts.) 

□  I  delegate  day-to-day  responsi¬ 
bility  for  IT  architecture,  infra¬ 
structure  and  integration  to 
direct  reports,  such  as  a  G 1  • 

(2  pts.) 


7.  What  are  your  IT  staff 

arD  "foversee  all  IT  staff,  including 
those  dispersed  among  busi¬ 
ness  units.  (5  points) 

□  I  oversee  headquarters  I  s  a  , 
while  those  dispersed  among 
business  units  report  to  then- 
unit  leadership.  (0  pts.) 

□  My  in-house  staff  is larger t **1 
the  number  outsourced.  (4  pts.) 
n  The  great  majority  of  IT  func¬ 
tions,  including  some  manage¬ 
ment,  is  outsourced.  (0  pts.) 


9.  How  are  IT  policies  formed  . 

□  I  independently  set  policies  for 
enterprisewide  concerns, 
including  business  processes, 
security  and  compliance. 

(2  points)  .  . , 

□  I  set  policies  for  enterpnsew.de 
concerns  in  collaboration  with 
other  executives  and  business 
leaders.  (5  pts.) 

□  Business  units  set  some  oi  a 
policies  on  business  processes, 
security  and  compliance, 
according  to  their  needs.  (0  pts.) 
n  I  hold  authority  and  accoun  a- 
bility  for  major  IT  contracts  and 
procurements.  (3  pts.) 

□  Business  units  make  some  or  all 
decisions  on  major  IT  contracts 

and  procurements.  (0  pts.) 


8.  How  are  IT  responsibilities 

h3Qd  I  oversee  enterprise  architec¬ 
ture  policy.  (5  points) 

□  I  hold  authority  and  accounta¬ 
bility  for  IT  architecture,  infra¬ 
structure  (including  apphca- 


10.  What  IT  best  practices  do 
vou  use? 

□  My  IT  group  consistently  uses 

methods  such  as  internal  IT  cat¬ 
alogs,  benchmarking  or  charge- 
back  systems  to  show  trans- 

parency  of  IT  costs.  (4  points) 


S 
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□  My  IT  group  consistently 
applies  project  management 
best  practices,  such  as  prototyp¬ 
ing,  tracking  and  post-imple¬ 
mentation  auditing.  (3  pts.) 

□  I  partner  with  a  business-unit 
sponsor  on  major  IT  capital 
initiatives.  (4  pts.) 

□  I  lead  major  IT  capital  initia¬ 
tives  without  a  business-unit 
sponsor.  (0  pts.) 

□  My  IT  group  has  a  formal  lead¬ 
ership  development  program. 

(3  pts.) 

11.  What  is  your  job  experience? 

□  I  have  a  technology  back¬ 
ground.  (5  points) 

□  I  have  experience  in  both  IT 
infrastructure  and  applications 
development.  (2  pts.) 

□  I  have  expertise  with  most  or  all 
of  my  organization’s  mission- 
critical  applications.  (2  pts.) 

□  I  have  business  knowledge  rele¬ 
vant  to  the  operational  environ¬ 
ment  of  my  company’s  vertical 
industry  or  market.  (2  pts.) 

□  I  have  demonstrated  financial 
and  accounting  acumen,  either 
in  business  or  in  an  educational 
program.  (3  pts.) 

□  I  have  business  management 
experience,  such  as  leading  a 
profit-and-loss  unit.  (3  pts.) 

□  My  job  experience  draws  from 
multiple  job  functions  and 
industi  ies  and  spans  more  than 
20  years.  (2  pts.) 

D  I  have  management  experience 
in  more  than  one  country 
(1  pt.) 

□  I  have  management  experience 
with  a  distributed  IT  environ¬ 
ment  and  a  matrixed  organiza¬ 
tional  structure.  (2  pts.) 

i  J  I  have  management  experience 
in  multiple  staffing  and  sourc¬ 
ing  arrangements.  (2  pts.) 

Li  I  have  management  experience 
in  lesource  and  project  manage¬ 
ment.  (1  pt.) 


□  I  have  management  experience 
in  crisis  response  and  recovery. 
(2  pts.) 


12.  How  strong  are  your  soft  skills? 


□ 


□ 


□ 


□ 


□ 


□ 


□ 


□ 


I  have  an  “elevator  speech” 
prepared  on  IT’s  role  in 
enabling  and  driving 
innovation  and  competitive 
differentiation  for  the  enter¬ 
prise.  (4  points) 

I  am  conversant  in  business 
and  financial  terminology, 
including  that  particular  to  my 
organization’s  industry.  (3  pts.) 

I  am  an  experienced  negotiator. 
(4  pts.) 

I  have  recently  tried  to  convince 
business  executives  or  man¬ 
agers  that  they  have  unrealisti¬ 
cally  high  or  low  expectations 
of  what  IT  can  do  for  them. 

(10  pts.) 

I  have  personal  connections 
with  people  in  all  of  the  follow¬ 
ing  roles:  corporate  officer, 
function  head,  business  partner 
and  supplier.  (4  pts.) 

I  am  an  experienced  public 
speaker.  (2  pts.) 

I  have  been  an  instructor  for  a 
course  or  have  been  a  mentor  in 
a  formal  program.  (1  pt.) 

My  coworkers  would  consider 
me  emotionally  intelligent. 

(3  pts.) 


13.  How  good  is  the  fit  between  you 

and  your  organization? 

D  I  can  summarize  the  core  values 
and  mission  statement  of  my 
organization.  (2  points) 

□  I  agree  with  the  core  values  and 
mission  statement.  (2  pts.) 

□  My  organization  has  no  core 
values  or  mission.  (0  pts.) 

□  I  feel  “at  home”  with  the  culture 
of  my  organization.  (5  pts.) 


For  self-help  advice  specific  to  each 
question,  read  “How  to  Make  Your 
Reality  More  Ideal”  on  Page  88. 
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spectrum  itself.  So  one  is  sure  to  fit  your  business 


Color  is  improving  work  everywhere.  And  no  one  is  more 
committed  to  enhancing  how  people  use  color  than  Xerox. 
Our  wide  array  of  award-winning  digital  color  devices  makes 


it  easy  to  custom  fit  a  color  solution  for  just  about  any 
business.  And  just  as  impressive  are  the  hands-on  extras  we 
can  provide,  like  workflow  expertise,  process  improvement 


Xerox  color  printers 
multifunction  systems 
&  digital  presses 


xerox.com/color  1-800-ASK-XEROX  ext.  COLOR 


©  2005  XEROX  CORPORATION.  All  rights  reserved.  XEROX*  and  Xerox  Color.  It  makes  business  sense  are  trademarks  of  XEROX  CORPORATION  in  the  United  States  and/or  other  countries. 


and  digital  presses  are  as  varied  as  the  business 


like  a  glove.  Xerox  olor. 

techniques,  and  managed  services  that  make  color  productive 
and  effective.  Xerox  color  integrates  easily  into  any  network. 
Our  supplies  are  economical.  And  our  line  is  so  affordable, 


It  makes  business  sense. 

it’s  within  reach  of  small  businesses  as  well  as  large 
global  companies.  Why  not  try  Xerox  color  on  for  size?  We 
promise  a  fit  that  works  hand  in  glove  with  your  business. 


XEROX. 


Technology 


Document  Management 


Consulting  Services 


What  do  your  answers  mean? 

1  To  whom  do  you  report?  A  direct  reporting  line  to  the  CEO 
1  indicates  that  IT  plays  a  significant  role  m  the  orgamza  10  • 
CIO-CEO  reporting  relationships  are  becoming  less  com  mo  ,  c 
Hcularlv  among  small  and  midsize  companies,  and  more  peopk 

are  reporting  to  their  CFOs,  according  to  our  State  of  the  CIO  s 

vek  Experts  on  organizational  structure  make  a 
ever,  between  reporting  to  operationally  oriented  CFOs  a 
financially  oriented  CFOs.  The  former  are  akin  to  COOs  and 
be  more  in  touch  with  a  company's  day-to-day  functioning  than  a 
CEO.  Thus  reporting  to  the  CEO  isn't  the  only  option  for  influen¬ 
tial  CIOs. 

/>  What  is  your  functional  title?  Companies  that  take  the  CIO 
2  role  seriously  usually  assign  a  functional  title  of  vice  presi¬ 
dent  or  higher.  In  "The  State  of  the  CIO  2004"  survey,  39  percent 
of  respondents  were  vice  presidents.  6  percent  were  senior  vice 
presidents,  and  2  percent  were  executive  vice  presidents.  Anoth 
24  percent  had  CIO-only  titles.  But  29  percent  were  directors,  a 
title  indicating  that  the  top  IT  exec  is  far  down  the  totem  pole. 

Are  you  a  member  of  the  executive  committee?  Member- 

3  ship  on  the  executive  committee  is  regarded  as  the  single  most 
important  indicator  of  a  CIO's  impact.  Even  the  reporting  lela- 
tionship  is  secondary. 

m  What  is  the  board  of  directors’  involvement  with  IT?  -Board 

4  involvement  with  IT  is  increasing,  particularly  m  light  o 
concerns  about  compliance  with  the  Sarbanes-Oxley  Act  A  board 
member  who  champions  IT  concerns  can  be  an  invaluable  asset 
for  a  CIO.  A  few  companies-FedEx  for  one-even  have  standing 
committees  for  IT  oversight. 

Who  are  your  main  constituents?  Who  a  CIO  works  with  is 
5  at  least  as  important  as  the  reporting  relationship.  CIOs  should 
have  strong  working  relationships  with  other  CXOs  and  business 
leaders.  Working  with  the  IT  staff  is  a  given,  but  that  alone  is  not 

sufficient  for  today  s  CIOs. 

r*  How  is  IT  governance  accomplished?  IT  governance  is  the 
O  mechanism  for  CIO  effectiveness.  Many  different  governance 
i  processes  can  be  effective,  but  senior  management  participation 
is  key  A  CIO  unilaterally  determining  governance  processes  is 
S  shouting  into  the  void.  Another  key  to  good  governance  is  that  the 
1  processes  are  widely  understood. 

I  -7  What  are  your  IT  staff  arrangements?  Outsourcing  is  a  given 

I  /  in  most  IT  environments.  The  key  question  for  CIOs  is 

»  whether  they  control  the  outsourcing  or  are  controlled  by  it.  T 
I  ratio  of  in-house  staff  to  the  number  outsourced  is  a  simple  means 

1  of  calculating  control.  The  CIO  needs  a  substantial  core  °f  Street 
reports  to  maintain  authority  and  ensure  a  responsive  and  flexible 


IT  function.  A  separate  issue  is  who  oversees  IT  staff  in  busine 
units.  The  presence  of  IT  staffers  who  report  solely  to  business  un 
managers  tends  to  lead  to  siloed  systems  and  fragmented  IT  go 

ernance. 

O  How  are  IT  responsibilities  handled?  Many  organizations 
O  distribute  authority  for  aspects  of  architecture,  infrastruc¬ 
ture  and  integration  on  the  grounds  that  different  business  urn 

have  very  different  needs.  But  CIOs  who  have  both  oversight  and 

personal  knowledge  of  the  architecture  and  applications  appro¬ 
priate  for  the  enterprise  and  business  units  can  achieve  the  proper 
mix  of  customization  and  centralization. 

f*.  How  are  IT  policies  formed?  The  CIO  should  have  significant 
9  input  on  enterprisewide  concerns  in  which  IT  plays  a  lg 

role,  such  as  regulatory  compliance.  But  policy-making  should  be 
done  in  conjunction  with  other  stakeholders  rather  than  unilat¬ 
erally.  When  it  comes  to  major  IT  contracts  and  procurements. 
CIO  control  is  critical. 

4  f\  What  IT  best  practices  do  you  use?  Best  practices  for  IT 

10  are  no  secret,  but  their  implementation  is  often  dependen 
on  other  functions  within  an  organization.  Implementing  anc 
maintaining  a  leadership  development  program,  for  examp  , 
takes  a  great  deal  of  collaboration  with  the  HR  othce. 

-  What  is  your  job  experience?  In  the  debate  over  the  best 

11  background  for  ClOs-technology  or  busmess-both  sides 
win  Technology  training  and  experience  is  a  must-have.  CIOs 
who  have  to  delegate  technical  competence  are  at  a  disadvan  age 
with  vendors,  consultants,  tech-savvy  executives  and  then  IT 
staff  But  business  skills  also  are  essential;  an  IT  executive  w 
outstanding  technology  skills  but  no  business  acumen  wont  bean 
executive  for  long.  Management  experience,  particularly  in  ai  e 
that  are  highly  relevant  to  IT-such  as  crisis  response  and  project 
management— sets  top  CIOs  apart  from  the  rest.  Because  of  the 
multinational  nature  of  the  IT  workforce,  CIO  work  experience  i 
more  than  one  country  is  increasingly  desirable. 

W  «  HOW  strong  are  your  soft  skills?  Soft  skills  such  as  lead- 
12  el-ship,  negotiation  ability  and  emotional  intelligence  are 
the  hardest  to  pin  down  but  among  the  most  important  for  CIOs 
today.  IT  execs  need  to  change  their  reputation  as  introverted 
geeks  if  they  want  to  succeed. 

4  How  good  is  the  fit  between  you  and  your  organization? 

lo  An  executive’s  fit  with  the  values  and  culture  of  his  organ¬ 
ization  should  not  be  underestimated.  One  executive  recruiter 
says  that  a  CIO  with  three-quarters  of  the  skills  for  a  job  opening 
can  succeed  if  his  values  match  the  organization's,  but  a  perfect 
skill  set  can’t  overcome  a  poor  cultural  fit. 
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Where  IP  and  telecom  unite. 
Where  security  is  offensive,  not  defensive. 
Where  e-commerce  is  safe  commerce. 
Where  content  is  mobile  and  personal. 

Where  infrastructure  is  more  intelligent. 
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VeriSign! 

Where  it  all  comes  together; 


Billions  of  times  each  day,  the  world  interacts  with  a  company 
you  may  not  realize  is  there.  One  that  is  driving  dynamic 
transformations  at  the  very  core  of  commerce  and  communications. 
VeriSign."  Through  our  Intelligent  Infrastructure  Services,  we  enable 
businesses  and  individuals  to  find,  connect,  secure,  and  transact 
across  today’s  complex  Internet,  telecom,  and  converged  networks. 

We  operate  the  systems  that  manage  .com  and  .net,  handling 
14-billion  Web  addresses  and  emails  every  day.  We  run  one  of  the 
,  largest  telecom  signaling  networks  in  the  world,  enabling  services 
•  such  as  cellular  roaming,  text  messaging,  caller  ID,  and  multi- 
media  messaging.  We  manage  network  and  user  security  for  over 
3,000  global  businesses  and  400,000  Web  sites.  And  we  handle 


over  30  percent  of  all  e-commerce  transactions  in  North  America, 
processing  $100-million  in  daily  sales.  As  next-generation  networks 
emerge  and  converge,  VeriSign  will  be  there,  deploying  the 
Intelligent  Infrastructure  Services  necessary  for  everything  from 
RFID-enabled  supply  chains  to  inter-enterprise  VoIP  to  mobile  and 
rich  media  content  distribution. 

Whether  you’re  a  telecom  carrier  looking  to  rapidly  deploy  new 
services;  a  Fortune  500  enterprise  needing  comprehensive, 
proactive  security  services;  or  an  e-commerce  leader  wanting 
to  securely  process  payments  and  reduce  fraud,  we  can  help. 
We’re  VeriSign.  Where  it  all  comes  together.'" 
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M I  motorola 

intelligence  everywhere 


Motorola  Commercial  Government  Solutions  Sector  is  the  recipient  of  the  2002  Malcolm  Baldrige  National  Quality  Award.  MOTOROLA  and  the  stylized  M  Logo  are  registered  in  the  US  Patent  and  Trademark  Office.  ©  Motorola,  Inc.  2004. 


A  Critical  Network  will  keep  this  from  becoming  a  bigger  crisis. 


Phone  lines  are  down.  Cellular  and  cable  networks  are  down.  But  all  responders  remain 
in  contact  and  receive  the  information  and  commands  they  need.  A  public  safety- 
controlled  Motorola  Critical  Network  provides  "always  available"  information,  reliably, 
using  secure  features.  That  means  they  can  coordinate  their  efforts  and  designate  areas 
to  search,  rescue,  and  maintain  order. 


Discover  how  standards-based  Mission  Critical  solutions  powered  by  a  Critical  Network 
help  agencies  serve  the  public,  even  when  other  systems  fail.  Call  1-800-367-2346 

lor  your  free  copy  of  Always  Available: 
te  the  Mission  Critical  Communications  series. 

It's  the  intelligence  you  need  in  an  unpredictable  world. 
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^  to  the  IT  Promised  Land  v 

How  one  CIO’s  budgeting  blues  led  to  an  organizational  revamp  at  Assemblies  of  God 


Reader  ROI 

::  The  linkages  among 
budgeting,  organizational 
structure,  workflows 
and  corporate  culture 

::  Transforming  a  cost-plus 
budgeting  system  to  a 
value-based  one 

::  The  systems  thinking 
approach  to  analyzing  orga¬ 
nizational  performance 


Tim  Strathdee,  a  kind  and  gentle  soul 

by  any  account,  ruthlessly  pitches  99  percent  of  all  junk  mail  that  hits 
his  inbox.  But  in  August  of  2002,  the  CIO  of  the  Assemblies  of  God 
(AG)  U.S.  headquarters  in  Springfield,  Mo.,  was  gearing  up  to  prepare 
his  budget  for  the  coming  fiscal  year,  an  annual  exercise  in  frustration. 
So  when  he  saw  a  mailing  about  a  variation  of  activity-based  costing, 
he  opened  it.  Read  it.  And  then  called  the  author,  Dean  Meyer. 

Strathdee  was  dreading  budget  season  because  the  AG  process  fol¬ 
lowed  a  typical  cost-plus  model,  in  which  a  department’s  annual 
budget  is  based  on  the  previous  year’s  amount,  plus  a  percentage  for 
inflation  or  other  factors.  Once  approved,  a  cost-plus  budget,  which 
remains  the  predominant  method  of  budgeting  in  corporate  Amer¬ 
ica  today,  functions  as  a  checkbook  to  which  no  funds  can  be  added. 

by  ALICE  DRAGOON 


www.cio.com  |  APRIL  1,  2005 


91 


Organizational  Change 


“People  did  not  talk  to  each  other.  I  don’t 
mean  they  didn’t  trust  each  other.  They 
were  so  passionate  about  what  they  were 
doing,  they  just  went  along  and  did  it.” 

-HAROLD  SALLEE,  ASSISTANT  TO  THE  GENERAL  SUPERINTENDENT, 

ASSEMBLIES  OF  GOD  HEADQUARTERS 


Strathdee  was  evaluated  primarily  on 
whether  he  stayed  within  budget,  not  on 
how  much  value  he  provided  to  his  cus¬ 
tomers.  So  when  departments  wanted  IT’s 
help  to  launch  new  initiatives,  he  could  do 
no  more  than  add  their  requests  to  his  grow¬ 
ing  queue  and  hope  that  he  could  pilfer 
money  from  somewhere  else  in  his  ever-so- 
fixed  budget. 

But  what  began  as  a  conversation  with 
Meyer  about  building  a  more  value-driven 
budget  for  the  IT  department  would  ulti¬ 
mately  turn  into  a  multiyear  project  to 
transform  the  budgeting  process  of  the 
entire  AG  headquarters’  operation— and  its 
organizational  structure,  workflows  and 
even  its  culture.  Along  the  way,  Strathdee’s 
role  would  morph  from  catalyst  to  design 
team  committee  member  to  behind-the- 
scenes  thought  leader. 

While  the  goal  of  supporting  missionary 
work  is  unusual  in  some  ways  (for  exam¬ 


ple,  few  corporations  begin  and  end  each 
meeting  with  a  prayer),  many  of  the  organi¬ 
zational  issues  that  AG  leaders  wrestle  with 
are  no  different  from  those  facing  the  most 
profit-driven  companies  publicly  traded  on 
Wall  Street.  Companies  fret  about  losing 
customers;  AG  leaders  were  scratching 
their  heads  over  a  slowdown  in  church 
growth  in  the  late  ’90s.  AG’s  Gospel  Pub¬ 
lishing  House,  which  produces  more  than 
16  tons  of  literature  a  day,  was  facing  declin¬ 


ing  revenue.  Field  reps  met  with  increased 
competition  as  they  marketed  everything 
from  Sunday  school  curricula  to  magazines 
for  the  Royal  Rangers  and  Missionettes 
(AG’s  version  of  Boy  Scouts  and  Girl  Scouts) 
to  more  than  12,000  independent-minded, 
self-governing  AG  churches  across  the 
country.  General  Superintendent  Thomas 
Trask,  AG’s  CEO-equivalent,  worried  that 
the  relevance  of  AG’s  products  and  services 
was  diminishing.  And  since  publishing 
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Threats 

Strategies  for 
Securing  the 
Enterprise 


CSO 


Custom  Publishing 
Advertising  Supplement 


Best  Practices  for  Fighting  Back  •  Positive  Identification 
Stopping  Spyware  and  Spam  •  New  Help  for  IT 


Hang  the  sign  on  the  door.  Because  with  the  SurfControl  security  solution  you  have 
the  peace  of  mind  of  knowing  that  the  threat  of  malicious  attacks  are  gone  from  your 
network.  Phishing?. ..Gone.  Spam?. ..Gone.  Spyware?. ..Gone.  And  with  them,  gone 
are  the  risks  of  confidential  data  loss  and  compliance  breach,  lost  productivity  and 
increased  legal  liability. 

Free,  30-day  trial  www.surfcontrol.com/go/phishing 
or  call  us  at  1  800.368.3366. 


Filters 

Web,  E-mail,  IM/P2P,  Mobile 


Threat  Prevention  Leadership 

Over  20,000  Customers 
Largest  Content  Database 
Day-Zero  Protection  Technology 
Global  Threat  Command  Centers 
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I’m  Secure, 
You’re  Secure 

By  Tom  Field 

No  question  about  it:  Dealing  with  viruses,  spam,  spyware,  network  intru¬ 
sions  and  other  security  threats  remains  a  top  priority  for  every  IT  organiza¬ 
tion.  But  these  days,  business  value  is  an  equally  critical  consideration. 

Or  at  least  that’s  what  my  friends  in  the  information  security  industry  tell 

me.  After  years  of  scaring  business  and  technol¬ 
ogy  leaders  into  protecting  their  enterprises  from 
vandals,  denial-of-service  attacks  and  infected  e- 
mail,  security  experts  are  now  adding  another  ele¬ 
ment  to  the  mix.  Instead  of  just  playing  on  our 
fears,  they’re  trying  to  build  up  our  confidence  as 
well.  Their  basic  message  is,  “Look  at  all  you’ve 
done  to  protect  your  enterprise.  Now  look  at  what 
else  you  can  do  to  take  control  and  batten  down 
the  virtual  hatches — without  wasting  a  bundle.” 

I  call  it  the  “I’m  Secure,  You’re  Secure” 
approach  to  promoting  information  security. 

The  point  is,  we’ve  all  come  to  realize  that  security  is  more  than  a  neces¬ 
sary  expense.  It’s  a  business  investment  like  any  other,  one  that  must  be 
made  carefully  and  measured  for  the  value  it  delivers. 

And,  boy,  there  are  plenty  of  investment  opportunities  out  there!  CXO 
Media’s  sister  company,  IDC,  reports  that  IT  security  spending  is  set  to 
grow  by  16  percent  this  year,  with  some  product  areas  receiving  double  the 
investment  they  saw  last  year. 

So  let  us  help  you  spend  your  money  wisely. 

Welcome  to  the  first  2005  edition  of  CIO  Spotlight,  in  which  we  focus 
squarely  on  information  security.  In  addition  to  helping  you  identify 
threats  and  opportunities,  this  special  edition  aims  to  hammer  home  the 
importance  of  having: 

•  Good  IT  governance 

•  Solid  security  goals  and  policies 

•  A  well-orchestrated  plan  for  regulatory  compliance 

•  The  right  tools  for  making  it  all  happen. 

As  you  read  the  expert  advice  and  case  studies  in  this  issue,  consider  how 
you  can  apply  the  insights  and  lessons  learned  in  your  own  organization. 
And,  please,  don’t  hesitate  to  let  us  know  about  strategies  that  have  worked 
for  you.  Send  me  your  thoughts  and  we’ll  share  them  in  the  next  edition  of 
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4  Taking  Control: 

Best  Practices  for 
Fighting  Back 

1 2  Identity  and  Access 

Management: 
Knowing  Who’s  Who 

1 4  Spyware  and  Spam: 
Worse  Than  Ever 

1 6  Networks  and 
Infrastructure: 

New  Help  for  IT 

1 9  Solutions  Center 


Torn  Field  is  director  of  content  development  for  CXO  Media’s  Custom  Publishing  Group. 
Please  send  your  thoughts  on  CIO  Spotlight  to  Tom  at  tfteld@cxo.com. 
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Information  Security 


TAKING  CONTROL: 

Best  Practices  for 

Fighting  Back 

SECURITY  THREATS  become  increasingly 
diverse,  sophisticated,  coordinated  and  vir¬ 
ulent  almost  by  the  day.  For  example,  after 
just  24  hours  in  the  wild  last  autumn,  a  variant  of  the 
Bagle  virus,  spread  by  spam,  became  one  the  most 
prolific  viruses  ever,  rapidly  replicating  itself  and 
bogging  down  corporate  e-mail  servers.  Meanwhile, 
tools  available  on  the  Web  make  it  easier  than  ever 
for  even  amateur  hackers  to  launch  attacks. 


That  explains  why  more  than  half  of  the  chief 
security  officers  queried  at  the  second  annual  CSO 
Interchange  conference  in  December  2004  listed  as 
their  top  security  concerns  worms,  viruses,  Trojan 
horses  and  regulatory  compliance.  In  the  same 
survey,  62  percent  said  they  don’t  receive  early 
enough  warning  about  Internet-related  threats, 
while  fully  80  percent  acknowledged  that  such 
attacks  have  hurt  their  companies’  bottom  lines. 

No  question  about  it:  Keeping  up  with  constant 
security  threats  is  a  significant  challenge.  But  as 
more  organizations  become  aware  of  their  vulnera¬ 
bilities  and  shortfalls — too  often  learning  the  hard 
way— they’re  fighting  back.  No  wonder  security- 
related  spending  has  grown  steadily  over  the  past 


several  years  while  investment  in  other  technology 
areas  stayed  flat  or  declined.  In  fact,  86  percent  of 
businesses  plan  to  increase  their  security  invest¬ 
ments  this  year,  according  to  research  from 
Framingham,  Mass. -based  IDC. 

“Companies  buy  insurance,  employ  security 
guards  and  decide  how  much  to  invest  in  screen¬ 
ing  employees  based  on  experts’  calculations  of 
expected  risk,  the  cost  of  a  loss  and  the  cost  of 
insurance  to  protect  against  that  loss,”  says 
Rebecca  Wettemann,  an  analyst  at  Nucleus 
Research  Inc.,  a  Wellesley,  Mass. -based  market 
research  firm.  She  recommends  that  organizations 
apply  the  same  kind  of  risk-benefit  evaluation  to 
their  IT  infrastructures.  “IT  managers  can  add 
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Meeting  Compliance 
Challenges 

How  ARE  ENTERPRISES  dealing  with  Sarbanes-Oxley 
and  other  new  laws  and  regulations  that  have  an 
impact  on  their  IT  security?  Among  the  common 
approaches: 

Standardizing  IT  security  governance  efforts.  After  pas¬ 
sage  of  the  Sarbanes-Oxley  Act,  Allstate  Corp.  turned  to 
the  IT  Governance  Institute’s  Control  Objectives  for 
Information  and  Related  Technology  (COBIT),  which 
help  ensure  alignment  between  business  strategies  and 
technology  investments.  Allstate,  the  Northbrook,  111.- 
based  insurance  giant,  uses  COBIT  to  evaluate  IT  gover¬ 
nance,  obtain  benchmarks  for  assessing  automated 
controls  embedded  in  key  business  processes  and  assess 
application-support  team  control  activities. 

The  big-picture  payoff:  Allstate  has  achieved  consis¬ 
tent  controls  to  improve  the  efficiency  and  effectiveness 
of  its  business. 

Using  certified  auditors.  “As  IS  auditors  travel  through¬ 
out  an  organization,  they  are  able  to  see  and  verify 
which  parts  of  the  information  security  policy  are  being 
complied  with,  and  can  offer  suggestions  on  improving 
compliance  or  making  suitable  updates  to  the  policy,” 
says  Marios  Damianides,  CISM,  CISA,  CPA,  a  New 
York-based  partner  in  the  Technology  and  Risk  Services 
Group  at  Ernst  &  Young.  “The  IS  auditor  also  comes 
across  systems  or  situations  that  are  not  adequately 


addressed  in  the  policy  and  offers  guidance  on  those. 

An  active  IS  audit  function  can  make  the  difference 
between  an  effective,  living  IT  security  policy  and  a 
dormant  one.” 

Damianides  is  also  international  president  of  the 
Information  Systems  Audit  and  Control  Association 
(ISACA)  and  the  IT  Governance  Institute  (ITGI),  both 
based  in  Rolling  Meadows,  Ill.  More  than  1,300  ISACA 
Certified  Information  Systems  Auditors  (CISAs)  are 
currently  employed  as  CEOs,  CFOs,  CIOs  or  IS  security 
directors.  About  1 1,000  more  serve  as  audit  directors, 
managers  or  consultants  in  IT  operations,  security  or 
auditing  positions. 

Centralizing  access  control.  Affymetrix  Inc.,  a  Santa 
Clara,  Calif.-based  biotech  firm,  takes  compliance  seri¬ 
ously.  Protecting  the  company’s  valuable  intellectual 
property  is  a  strategic  necessity.  Thanks  to  a  solution 
from  Encentuate,  of  Foster  City,  Calif.,  Affymetrix  got 
out-of-the-box  compliance  for  13  of  15  applications 
directly  affected  by  Sarbanes-Oxley.  In  addition,  simpli¬ 
fying  sign-on  and  password  management  for  1,000 
employees  generated  savings  of  more  than  $200,000  in 
just  six  months. 

“Compliance  requirements  are  forcing  companies  to 
strengthen  their  security,  often  at  the  expense  of  user 
convenience,”  says  Encentuate  founder  and  CEO  Peng 
Ong.  “The  best  solutions  will  allow  IT  to  strengthen 
security  and  at  the  same  time  provide  users  with 
increased  convenience.  We  call  this  enterprise  access 
security — a  single  solution  that  will  allow  an  enterprise 
to  simplify,  strengthen  and  track  access  across  informa¬ 
tion  systems.” 


value  by  clearly  understanding  the  relative  costs  and  ben¬ 
efits  of  different  technology  strategies  and  by  working 
with  the  risk  experts  to  map  the  best  strategy  for  the 
organization,”  she  says. 

Got  mandate? 

What  you  do  about  protecting  your  company  against 
such  threats  depends  on  the  nature  of  your  business  as 
well  as  its  culture  and  leadership.  Are  your  company’s 
executives  oblivious  to  the  risks?  In  that  case,  you’ll  need 
to  start  by  educating  them.  On  the  other  hand,  if  they 
are  aware  of  recent  threats,  they’re  likely  already 
demanding  action. 

Either  way,  once  you  have  a  mandate  to  improve  IT  secu¬ 
rity,  it’s  wise  to  begin  with  these  components: 


•  A  thorough  assessment  of  the  threats  your  enterprise 
faces,  including  all  vulnerabilities  and  risks 

•  Solid  security  strategy  goals,  with  tactics  detailed  in  a 
company  security  policy 

•  An  implementation  approach  that  fits  your  organization’s 
processes,  culture  and  infrastructure 

•  The  right  tools  and  solutions,  chosen  for  their  concord 
with  your  needs,  goals  and  methodology 

•  Dedication  to  proper  ongoing  management  and 
maintenance. 

“Targeted  attacks,  as  well  as  worms  and  viruses  like  SQL 
Slammer  and  Nimda,  are  proof  positive  of  the  need  to  have  a 
comprehensive  corporate  security  policy  that  is  approved  and 
adopted  by  the  senior  management  team,”  says  Betty  Johnson, 
vice  president  of  IT  at  the  Santa  Cruz,  Calif.-based  Nonprofits 
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SAFENET 


Encryption  Technology:  Core 
Behind  Products  and  Solutions 


Solution  Provider:  SafeNet  Inc.  is  a  global  leader  in 
information  security.  Founded  more  than  20  years  ago, 
SafeNet  offers  complete  security  solutions— a  full  spec¬ 
trum  of  best-of-class  security  products  encompassing 
hardware,  software,  chips  and  intellectual  property, 
keeping  current  product  rankings  and  ratings. 

SafeNet's  core  strength  is  the  encryption  technology 
behind  its  products  and  solutions.  The  company  has 
been  awarded  43  distinct  patents,  with  31  additional 
pending  and  provisional  patents— many  of  which  are 
also  patented  in  various  countries  around  the  globe. 
As  further  evidence  of  its 
known  leadership  in  the 
field,  SafeNet  has  attracted 
more  than  300  encryption 
engineers,  building  one  of 
the  largest  teams  of  its  kind 
in  the  world. 


Product  and  Service  Offerings:  SafeNet  technology 
is  the  de  facto  standard  in  remote-access  client 
software  and  the  market  leader  in  USB  authentica¬ 
tion  tokens  that  eliminate  user  names  and  pass¬ 
words;  SSL  acceleration  devices  providing  fast  and 
secure  online  transactions;  licensing  products  pre¬ 
venting  software  piracy;  high-assurance  security 
products;  and  SecurelP  Technology  licensed  to 
Internet  infrastructure  manufacturers,  service 
providers  and  security  vendors. 

ROI:  "Our  partnership  enables  us  to  offer  a  complete 
solution  to  our  customers  that  is  OMA  DRM  v2  com¬ 


pliant  while  meeting  the  demands  for  increased 
security  and  flexibility,"  says  Cees  Geel,  marketing 
and  sales  director  for  SafeNet  partner  Philips 
Software.  "Through  this  cooperation  with  SafeNet,  a 
respected  world  leader  in  the  field  of  mobile  securi¬ 
ty,  we  have  an  ideal  partner  to  complement  our  own 
extensive  in-house  DRM  expertise  and  help 
strengthen  our  solutions  yet  further,"  Geel  says. 

"SafeNet's  technology  is  silicon-proven.  They  are  a 
profitable,  financially  sound  company  with  an  inter¬ 
national  presence,"  says  Sunil  Baliga,  vice  president 

of  marketing  and  business 
development  at  K-Micro 
(Kawasaki  Microelectronics),  a 
leader  in  advanced  yet  afford¬ 
able  ASICs.  "Thus,  partnering 
with  a  trusted  vendor  such  as 
SafeNet  will  help  K-Micro 

quickly  grow  in  markets  that  need  security  technolo¬ 
gy,  including  fiber-to-the-premises  (FTTP)  and  net¬ 
work  printers." 

Customers:  Samsung,  Texas  Instruments,  Nokia, 
Ericsson,  NEC,  ARM,  Bank  of  America,  NetGear,  the 
U.S.  Departments  of  Defense  and  Homeland 
Security,  Adobe,  the  U.S.  Internal  Revenue  Service 
and  scores  of  other  government,  financial  institu¬ 
tions,  midsize  firms  and  OEM  customers. 

Contact  information:  www.safenet-inc.com 

410-931-7500 

800-696-5308 


The  Foundation  of  Information  Security 


Insurance  Alliance  Group  of  Companies,  which  provides  lia¬ 
bility  insurance  for  charitable  nonprofit  organizations. 

The  starting  line 

“CIOs  and  IT  managers  need  to  take  part  in  risk  identifica¬ 
tion  and,  at  a  high  level,  understand  controls  and  vulnerabil¬ 
ities,”  says  Phebe  Waterfield,  CISSP,  a  senior  analyst  at  The 
Yankee  Group,  a  Boston-based  research  and  consulting  firm. 

More  important,  in  her  view,  is  understanding  business 
risks,  what  controls  are  in  place  to  mitigate  those  risks  and 


where  those  controls  are  weak  or  vulnerable.  “The  implica¬ 
tions  of  this  for  security  policy,  information  sharing  and  IT 
governance  are,  simply,  visibility,”  she  notes.  “Regulations 
require  more  visibility  and  greater  definition  around  IT 
process  and  procedure.  Loose  processes  and  vague  policies 
are  no  longer  acceptable  because  they  do  not  ensure  that  IT 
systems  are  operated  securely.” 

Chances  are  your  campaign  to  reduce  your  organization’s 
vulnerability  and  risk  will  be  anchored  by  one  of  these 
kinds  of  security  projects: 
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One  comprehensive,  modular  security  platform  —  Borderless  Security  from  SafeNet. 


The  Borderless  Security  Platform  from  SafeNet  effectively  combines  authentication,  authorization,  and  confidentiality  into  one 
strong  security  solution  that  eliminates  boundaries.The  Platform  removes  the  constraints  placed  on  business  by  traditional 
perimeter-based  solutions  and  security  point  products. These  uniquely  packaged  components  merge  multi-factor  authentication, 
enterprise  single  sign-on,  easily  managed  authorization,  and  certified  credential-based  confidentiality  into  one  tightly  integrated 
solution.  Working  seamlessly  together,  the  Platform  components  extend  your  existing  network  and  identity  management 
security  infrastructure. 


For  our  new  Borderless  Security  white  paper,  go  to  www.safenet-inc.com/borderless. 


Call  1-800-697-13 18  to  be  SafeNet  sure. 

www.safenet-inc.com 


Copyright  2005,  SafeNet,  Inc.  All  rights  reserved.  SafeNet  and  SafeNet  logo  are  registered  trademarks  of  SafeNet,  Inc. 
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Managing  multiple  user  accounts,  passwords  and 
authorizations  can  quickly  go  from  overwhelming 

to  all  but  impossible. 


. .  .Securing  your  network 

Doing  business  online — even  just  a  small  amount — means 
changing  the  way  you  handle  network  security.  This  trans¬ 
formation  can  range  from  reconfiguration  to  a  redesign  of 
the  architecture  itself. 

Aligning  what  you  have.  As  enterprises  open  up  their  IT 
environments  to  the  Internet,  network-perimeter  security 
techniques  must  adapt  to  two  often-conflicting  demands: 

•  The  need  to  protect  against  the  ballooning  volume  and 
variety  of  threats  as  well  as  a  tightening  margin  between 
discovery  and  malicious  exploitation  of  vulnerabilities. 

•  The  need  to  provide  easy  connectivity  and  data  access  for 
mobile  and  home-based  workers  and  outsiders,  such  as 
partners  and  suppliers.  Obviously,  such  arrangements 
provide  welcome  collaboration  capabilities,  but  they  can 
also  cause  vulnerabilities  that  could  compromise  sensitive 
information  and  network  security. 

As  a  result,  you  may  find  yourself  re-segmenting  your 
network  to  make  parts  of  it  more  secure — but  at  least  that 
provides  the  opportunity  to  build  closer  alignments  among 
IT,  security  and  business  needs. 

Meeting  demands  for  connectivity.  Longer  term,  you  may 
need  to  consider  new  network  architectures  that  can  isolate 
low-security  subnets  (such  as  one  with  employee  information 
that’s  neither  mission-critical  nor  confidential),  as  well  as 
security  policies  that  reflect  individual  business  units’  network 
security  considerations  based  on  their  risk,  availability  and 
access  requirements.  By  combining  such  technologies  as  vir¬ 
tual  private  networks  (VPNs)  and  Secure  Sockets  Layer  (SSL) 
with  identity  management  solutions,  you  can  enable  secure, 
enterprise-to-enterprise  partnering  and  collaboration. 

. .  .Standardizing/integrating 
IT  infrastructure 

In  many  corporate  IT  environments,  the  approach  used  to 
create  and  implement  applications  and  systems  could  be 
summed  up  as  seat-of-the-pants  at  best.  Security  risks, 
holes  and  vulnerabilities  abound. 

In  the  long  term,  you  can  resolve  that  situation  by  developing 
standards  regarding  software  development  and  acquisition. 
That  job  is  more  easily  accomplished  in  enterprises  that  are 
already  oriented  to  process  rationalization  using  methodologies 
such  as  Six  Sigma  and  TQM,  which  can  inject  security  stan¬ 
dards  and  tests  into  existing  process  controls  and  templates. 


. . .  Complying  with  new  laws 

To  meet  regulatory  requirements  such  as  the  Sarbanes- 
OxIeyAct,  the  Gramm-Leach-Bliley  Act,  the  Patriot  Act 
and  the  Health  Insurance  Portability  and  Accountability 
Act  (HIPAA),  your  organization  may  need  to  create  a  set 
of  security  controls  and  a  dedicated  team  to  oversee  them. 
That  group  should,  in  fact,  be  separate  from  IT,  which 
should  cede  the  reins  over  vulnerability  assessment,  intru¬ 
sion  detection  and  similar  tasks. 

Indeed,  if  your  enterprise  is  affected  by  such  regula¬ 
tions — and  virtually  all  organizations  are — you  can 
expect  formal  IT  security  governance  reviews  to  be  in 
your  future.  That’s  because  some  regulations  require  that 
certain  parts  of  an  organization’s  information  systems  are 
sufficiently  secured  and  the  actions  of  authorized  staff 
(read:  systems  administrators)  monitored.  IT  staff  watch¬ 
ing  IT  staff  doesn’t  meet  the  laws’  requirements;  often  a 
separate  security-control  operation  is  needed  to  meet  the 
audit  requirements. 

. .  .Managing  identities 

How  you  approach  the  authentication,  authorization  and 
access  control  challenges  inherent  in  enterprise-wide  iden¬ 
tity  management  will  likely  depend  on  what  kinds  of  prob¬ 
lems  you  need  to  solve. 

If  you’re  seeking  help  for  the  infrastructure  you  have  now, 
implementing  password  management  or  account  provi¬ 
sioning  solutions  can  ease  the  burden  of  supporting  your 
current  application  portfolio  and  provide  a  reduction  in 
help-desk  costs. 

If  you’re  doing  business  online,  or  preparing  to  do  so, 
you  already  know  that  managing  multiple  user  accounts, 
passwords  and  authorizations  can  quickly  go  from  over¬ 
whelming  to  all  but  impossible.  Rationalizing  these 
efforts  with  an  enterprise-wide  identity  infrastructure  via 
a  lightweight  directory  access  protocol  (LDAP)  directory 
and  a  Web  single  sign-on  (SSO)  engine  offers  a  founda¬ 
tion  for: 

•  The  kinds  of  federated  identity  capabilities  on  which 
inter-enterprise  partnering,  such  as  supply  chain  relation¬ 
ships,  depends 

•  The  centralized  authorization  services  necessary  to  use 
Web  services  architectures,  which  can  help  reduce  soft¬ 
ware  development  and  maintenance  costs.  CIOSL 
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Demand  Excellence 

Employ  Certified  IT  Professionals 


For  more  than  30  years  Information  Systems  Audit  and  Control 
Association®  (ISACA®)  has  been  certifying  professionals  with  its 
flagship  certification,  Certified  Information  Systems  Auditor™ 
(CISA®),  the  globally  accepted  standard  among  IS  audit,  control 
and  security  professionals.  In  2002,  ISACA  introduced  Certified 
Information  Security  Manager®  (CISM®),  a  groundbreaking 
credential  specifically  designed  for  information  security 
professionals  who  manage  an  information  security  function  of 
an  enterprise  or  have  information  security  management 
responsibilities.  Together  these  programs  have  certified  more 
than  40,000  people  worldwide. 

International  exposure,  recognition  of  advanced  job  skills, 
participation  with  a  global  leader  in  IT  certification-all  of  these 
benefits  are  obtained  through  achievement  of  an  ISACA 
certification. 


CISA 

Certified  Information  Systems  AvnrrnR'’ 


CISM 


CERTIFIED  INFORMATION  I 
SECURITY  MANAGER1  ' 


For  more  information,  visit  the  ISACA  web  site  at 

www.isaca.org/certification 


VI  IN  THE  WORLD 


S  Nuclear  Weaponry, 
jJJSjpefense  and  more) 


(Selected  by  large  global  financial  institutions,  major 
credit  card  companies,  and  leaders  in  the  insurance 
industry  for  cost  savings  and  improved  Security) 


SPECIAL  ADVERTISING  SUPPLEMENT 


Here’s  How 


Start  With  A  Breakthrough  In 
The  Positive  Security  Model 

Securify  enables  you  to  define  the  intention  of  your 
network.  Quickly.  Precisely.  With  the  positive  model, 
you  define  relationships  between  assets  that  you  have 
deemed  acceptable;  anything  else  is  an  exception.  This 
enables  the  clear  identification  of  threats  that  are  un- 
known-Uke  worms  before  a  signature  is  available-or 
employee  misuse.  The  breakthrough:  automated  mod¬ 
eling  of  intent  and  automated  generation  of  thousands 
of  rules,  and  dynamically  adapting  them  over  time. 

Add  The  Benefits  Of 

The  Negative  Security  Model 

The  negative  model  specifies  threats  and  vulnerabilities, 
then  matches  patterns  for  known  risks.  Securify  com¬ 
bines  the  positive  model  and  the  negative  model  so  you 
get  comprehensive  and  precise  detection,  automating 
the  elimination  of  false  positives.  Risk-based  prioritiza¬ 
tion,  complete  extranet  management,  and  more. 


Extranet  Control: 

This  global  bank  relied  on  IDS  and  managed  ser¬ 
vices  to  analyze  false  positives,  spending  millions  of 
dollars  in  threat  detection,  yet  not  able  to  manage 
out  violating  partners.  Securify  virtually  eliminated 
false  positives,  and  identified  numerous  misconfig- 
urations,  bringing  new  control  to  partner  manage¬ 
ment  while  saving  millions  of  dollars. 


Monitor  All  Network  Traffic  In  Real-Time 

Security  evaluates  all  traffic  in  relation  to  the  positive 
and  negative  models,  automating  the  contextual  un¬ 
derstanding  of  network  changes  and  security  threats. 
Save  money  and  improve  security  by  eliminating  human 
intervention  of  threats  and  network  change  analysis. 


Automate  Context  To  Harden 
The  Internal  Network 

Automate  the  priority  of  known  vulnerabilities.  Automate 
firewall  configuration  verification.  Automate  network 
compliance  audits.  Automate  risk-based  prioritization. 
With  Securify,  you  automate  the  analysis  and  get  preci¬ 
sion  in  action.  You  are  able  to  apply  more  resources  to 
remediation  and  change  management,  which  begins 
the  course  of  continuous  improvement  and  the  hard¬ 
ening  of  the  internal  network. 


Firewall  Configuration  Verification: 

This  global  credit  card  company  found  that  they  were 
getting  behind  in  firewall  configuration  verification. 
Regulatory  compliance  requirements  were  urgent, 
so  they  turned  to  Securify  to  reduce  the  amount  of 
time  to  verify  firewall  configurations  by  60%,  saving 
both  time  and  labor  cost,  and  improving  security. 


Rapid  Deployment,  Proven  Scalable 

Defining  the  intent  of  your  network  might  sound  like 
a  daunting  project.  It’s  not.  Most  Securify  customers 
are  up  and  running  in  days,  with  global  rollouts  com¬ 
pleted  and  operational  in  3-5  weeks.  And  Securify  is 
proven  in  400,000+  seat  networks.  Give  us  72  hours 
to  prove  it  to  you. 


Call  us  at  866-343-4505,  or  get  the 
white  paper  at  www.securify.com 


SECLR1FY 


MANAGE  NETWORK  CHANGE:  Configuration  Verification,  Network  Compliance  and  Audits 
IMPROVE  SECURITY:  Partner  Extranets,  Comprehensive  Threat  Detection  Without  False  Positives 


C  2005  Securify,  Inc.  All  rights  reserved. 
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Information  Security 

IDENTITY  AND  ACCESS  MANAGEMENT: 


Knowing  Who’s  Who 


HOW  DO  YOU  GAUGE 
trustworthiness? 
With  a  handshake? 
Intuition?  A  look  at  the  other 
guy’s  driver’s  license? 

To  protect  against  a  growing  number  of  threats,  IT  infra¬ 
structures  must  include  built-in  ways  to  establish  the  credi¬ 
bility  of  employees,  customers,  partners  and  suppliers.  How 
that’s  accomplished — via  tasks  involving  provisioning, 
authentication,  authorization,  access  control  and  audit¬ 
ing — is  what  identity  management  is  all  about. 

“We  must  ensure  that  patient  health  information  is  pro¬ 
tected  and  provide  audits  for  patients  who  wish  to  see  who 
had  access  to  their  health  care  records,”  says  John  Hummel, 
CIO  and  senior  vice  president  of  IS  at  Sutter  Health  Network, 
based  in  Sacramento,  Calif.  That  means  knowing  exactly  who 
users  are  as  they  log  into  the  organization’s  systems. 

The  solution:  software  and  procedures  that  can  assure  the 
identities  and  manage  the  access  rights  of  all  users,  devices, 
applications  and  organizations  that  are  attempting  to  inter¬ 
act  with  a  company’s  IT  resources.  The  Stamford,  Conn.- 
based  research  and  consulting  firm  Gartner  Inc.  reports  that 
costs  of  identity-management  solutions  vary  from  $5  to 
more  than  $25  per  user,  but  reductions  in  help-desk  costs 
alone  can  make  the  technology  a  good  investment. 

Automating  provisioning — that  is,  handling  user  access 
capabilities  automatically,  rather  than  manually — can  gener¬ 
ate  significant  savings  as  well.  According  to  Gartner,  auto¬ 
matic  provisioning  for  a  dozen  applications  in  a  10,000- 
employee  enterprise  can  cut  costs  by  $3.5  million  over  three 
years  and  produce  a  return  on  investment  of  nearly  300  per¬ 
cent.  Such  impressive  returns  come  chiefly  from  a  decreased 
need  to  manage  user  access  (an  annual  reduction  of  14,000 
hours)  and  a  6,600-hour-per-year  drop  in  help-desk  hours. 
And  automatic  user  provisioning  and  de-provisioning  make 
the  process  of  initiating,  changing  and  ending  individual 
access  rights  faster  and  less  prone  to  error. 


Beginning  with  a  directory 

Most  identity  management  systems  are  founded  on  a  directory 
or  directory  service  that  hierarchically  lists  and  categorizes 
users,  devices,  applications  and  organizations,  storing  such 
identity  attributes  as  authentication  details  and  access  rights. 

Traditionally,  several  distinct  programs  have  handled  these 
functions:  One  does  user  provisioning,  another  deals  with 
passwords,  a  third  stores  authentication  information.  Each 
program,  along  with  individual  user  access-control  lists,  must 
be  separately  maintained,  synchronized  and  kept  up  to  date. 

These  days,  companies  are  looking  for  solutions  that  will 
eventually  provide  federated,  enterprise-wide,  single  sign- 
on  solutions.  The  objective:  systems  that  are  interconnected 
so  that  workers  logged  into  their  corporate  intranets  can 
seamlessly  access  partners’  systems  with  authentication, 
authorization  and  access  credentials  automatically  recog¬ 
nized  and  accepted  across  enterprises. 

The  goal,  according  to  Rebecca  Wettemann,  an  analyst 
at  Wellesley,  Mass. -based  Nucleus  Research,  a  market 
research  firm,  is  “to  manage  integrity  and  security  with¬ 
out  locking  down  communications  in  a  way  that  nega¬ 
tively  impacts  the  business.” 

Rather  than  developing  a  single  blanket  policy,  companies 
should  identify  key  areas  where  documents  and  communica¬ 
tions  are  most  sensitive  and  look  for  appropriate  technology 
to  manage  them.  “Digital  identity  management  coupled  with 
digital  content  management  and  document-management 
solutions  are  good  starting  points,”  Wettemann  says,  “particu¬ 
larly  if  they  support  different  access  and  audit  levels  for  differ¬ 
ent  users,  groups  of  users,  and  types  and  pieces  of  content.” 

The  importance  of  federation 

Identity  management  solutions  will  increasingly  be  based 
on  Web  services  and  federated  standards  designed  to 
enhance  the  exchange  of  identity  information  between 
organizations  with  an  EDI-  or  a  PKI-like  exchange  of 
trusted  identity  characteristics.  So  perhaps  someday  in  the 
not-too-distant  future,  you’ll  be  able  to  count  the  number 
of  passwords  you  use  in  your  job  on  one  hand. 

Key  to  that  effort  is  the  establishment  of  a  single  identity 
management  standard,  such  as  the  XML-based  Security 
Assertion  Markup  Language,  that  everyone  can  embrace. 
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in  AbiImencentuatc 

Community  Medical  Center  Improves 
Patient  Information  Security 


STUDY 


Customer:  Community  Medical  Center  is 
the  largest  regional  health-care  provider 
in  central  California,  with  16  facilities, 
more  than  850  beds  and  6,100  clinical  and  non- 
clinical  employees.  Community  has  200  applications 
(legacy,  desktop  and  Web),  more  than  5,000  users 
and  2,600  desktops— of  which  more  than  half  are 
shared  by  multiple  users. 

Objectives: 

•Achieve  regulatory  compliance— access  control, 
audit  logs,  stronger  security 

•  Provide  secured  access  in  a  shared  workstation 
environment 

•  Offer  simplified  and  faster  access  to  all  applica¬ 
tions  in  a  highly  complex  and  heterogeneous 
environment 

•  Revoke  access  for  depart¬ 


ing  employees  and 
contractors 
>  Use  one  ID  badge  to 
access  both  building  and 
information  systems 


Results/Benefits: 

•Immediate  regulatory  compliance 

•  Faster  access  to  electronic  information 
•Satisfied  and  more  productive  staff 

•  Dramatic  reduction  in  help-desk  calls 

•  No  need  for  extensive  systems  integration 

•  Ability  to  transparently  increase  security  without 
user  involvement 

•  Unified  access  across  physical  and  information  systems 

•  Minimal  investment  because  the  solution  leverages 
existing  infrastructure 

From  the  Customer: 

"The  Encentuate  TCI  product  simply  works.  It  is 
easy  to  implement  and  provides  a  new  level  of  con¬ 
venience  for  both  IT  and  for  our  users. 

Encentuate  simplifies  the 
process  of  IT  administration, 


ENCENTUATE" 


Solution:  Encentuate  offers  an  Enterprise  Access 
Security  solution  that  simplifies,  strengthens  and  tracks 
access  to  information  systems.  The  Encentuate  solution 
is  unique  in  that  it  automates  sign-on/off,  manages 
strong  authentication  and  provides  audit  reports  by 
user.  Deployment  is  fast  and  cost  effective  because 
Encentuate  requires  no  change  to  existing  applications, 
uses  existing  ID  badges  and  is  adopted  rapidly  by  users. 


streamlining  our  security 
management  and  providing 
Security  Through  Convenience  consistency  between  plat¬ 
forms.  Encentuate  provides 
our  users  with  one  secure  password  to  our  applica¬ 
tions  and  flexibility  to  manage  how  users  access 
applications,  something  other  vendors  have  not 
easily  been  able  to  provide." 

—George  Vasquez,  Director  of  Technology  Services, 
Community  Medical  Center,  Fresno,  Calif. 


Contact  information:  info@encentuate.com 

www.encentuate.com 

650-312-8300 


Currently,  several  standards  are  battling  for  domination. 

The  competition  isn’t  deterring  identity  management 
solutions  providers,  however.  Encentuate’s  TCI  solution,  for 
instance,  includes  sign-on  automation,  integrated  access 
across  information,  network  and  physical  access  systems, 
support  for  physical  access  cards  as  second-factor  authenti¬ 
cation  and  a  roadmap  that  leads  incrementally  from  pass¬ 
words  to  a  strong  digital  identity. 

“As  the  future  unfolds,  network  access  devices  will  have  to 
be  built  with  strong  protective  shields,  such  as  firewalls,” 
notes  Peng  Ong,  founder  and  CEO  of  Foster  City,  Calif.- 


based  Encentuate.  “All  network  access  devices  will  have  to 
become  self-secured  nodes.”  The  implication:  Access  control 
will  move  from  location  to  identity,  from  where  to  whom. 

“Until  now,  companies  have  had  to  make  impossible 
choices,”  Ong  continues.  “They  could  opt  for  a  client-based 
point  solution  that  makes  life  easy  for  users  but  does  not 
provide  layered  security  upgrade  possibilities.  Or,  they 
could  choose  to  integrate  multiple  server-based  solutions, 
which  is  an  expensive  proposition.  What’s  needed  is  a  solu¬ 
tion  that  combines  convenience  for  users  with  central 
administration,  all  in  a  fast-to-deploy  package.”  CIC  SL 
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t  spotlight  on: 

Information  Security 


SPYWARE  AND  SPAM: 

Worse  _ 

Than  Ever 


\ 


Once  considered  mainly  a  problem  for  unprotected 
home  computers,  spyware  now  threatens  enterprise 
security,  turning  corporate  computers  into  spam¬ 
generating  machines  and  wreaking  other  havoc.  Two-thirds  of 
consumer  PCs  are  infected  with  some  sort  of  spyware,  accord¬ 
ing  to  estimates  from  the  Framingham,  Mass. -based  research 
and  consulting  firm  IDC,  whose  analysts  describe  infiltrating 
corporate  firewalls  with  malicious  spyware  as  an  easy  process. 


Spam,  meanwhile,  costs  U.S.  businesses  $4  billion  annu¬ 
ally  in  lost  productivity,  according  to  estimates  from  The 
Yankee  Group,  a  Boston-based  research  and  consulting 
firm.  A  recent  CSO  magazine  Sensor  Survey  identified 
spyware  as  the  No.  2  security-related  concern  (behind 
“blended  threats”  combining  the  characteristics  of  viruses, 
worms,  Trojan  horses  and  malicious  code  with  server  and 
Internet  vulnerabilities).  Spam,  or  unsolicited  bulk  e-mail, 
was  No.  3  because  it  clogs  networks  and  serves  as  a  vehicle 
for  other  security  threats,  such  as  viruses,  worms  and 
Trojan  horses — all  listed  individually  among  the  CSO's’  top 
10  concerns. 

“My  greatest  concern  is  really  spam — the  cost  and  effort  of 
keeping  up  with  spam  is  tremendous — as  well  as  viruses  and 
worms,”  says  John  Hummel,  CIO  and  senior  vice  president 
of  IS  at  the  Sacramento,  Calif.-based  Sutter  Health  Network. 

Why  you  should  care  about  spyware 

Spyware  is  software  that,  without  authorization,  selects  pri¬ 
vate  information  on  a  computer  and  sends  it  to  a  third  party. 


The  problem  began  with  adware,  which  often  appears 
benevolent  because  it  offers  users  “free”  screensavers,  down¬ 
load  accelerators  or  other  applications.  Home  users  typi¬ 
cally  install  those  programs  without  realizing  that  they’re 
likely  subjecting  themselves  to  pop-up  ads,  erratic  browser 
behavior  and  other  side  effects. 

Now  employers  face  related  problems:  the  loss  of  network 
bandwidth  due  to  unsolicited  advertising  traffic,  overloaded 
help-desk  staff  who  must  clean  up  adware-laden  desktop 
and  notebook  computers,  and  liability  risks  because  users 
can  be  unwillingly  exposed  to  unsavory  Web  sites. 

In  addition,  spyware  can  carry: 

•  Keystroke  logger/screen  capture  software  that 
surreptitiously  installs  and  hides  itself  and  then  records 
keystrokes  and  screenshots  that  can  be  used  to  recon¬ 
struct  a  user  session,  enabling  the  theft  of  passwords  and 
other  confidential  information.  Such  information  can  be 
used  to  break  into  networks  and  databases. 

•  Hacking  programs  such  as  password  crackers  and  Trojan 
horses  that,  once  successfully  deployed  on  unsuspecting 
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SURFCONTROL 

Richard  Petty  Driving  Experience 
Blocks  Multiple  Internet  Threats 


STUDY 


Customer:  The  Richard  Petty  Driving 
Experience  gives  racing  fans  the  ultimate 
thrill  of  racing  in  a  mega-horsepower 
stock  car  around  a  competition-style  speedway. 
Founded  in  1994  by  NASCAR  legend  Richard  Petty, 
the  Concord,  N.C. -based  company  currently  operates 
20-plus  tracks  nationwide,  offering  enthusiasts  a 
chance  to  experience  everything  from  a  165-mph 
ride  with  a  professional  driver  to  the  adrenal  rush  of 
taking  40  laps  behind  the  wheel. 


Objectives: 

•  Block  spyware  from  infiltrat¬ 
ing  the  network 

•  Prevent  spam  from  degrading 
e-mail  server  performance 

•  Stop  employee  Internet  abuse 


SurfControl 


Solution: 

SurfControl  E-mail  and  Web  Filters  provide  robust 
multilayer  protection  against  escalating  threats 
from  spyware,  phishing  attacks,  spam,  pornogra¬ 
phy  and  viruses.  SurfControl  E-mail  Filter  manages 
employee  e-mail  usage  and  significantly  reduces 
security  threats,  legal  liability,  network  abuse  and 
loss  of  productivity.  Through  risk  recognition, 
flexible  rules,  reporting  and  administration, 
SurfControl  Web  Filter  manages  employee  Internet 
access  and  stops  malicious  software,  inappropriate 
content,  recreational  surfing  and  other  threats. 


Results/Benefits: 

•  Decreased  spyware  incidence  by  45  percent 

•  Reduced  individual  mailbox  spam  by  95  percent 

•  Filtered  35,000  spam  messages  in  the  first  week  alone 

•  Enabled  end-user  management  of  spam  to  prevent 
loss  of  legitimate  e-mail 

•Implemented  blacklisting  to  block  known  spam  servers 

•  Reduced  time  spent  on  e-mail  administration 
•Tracked  Internet  usage  by  employee  to  investigate 

suspected  abuse 

From  the  Customer: 

"Because  we  are  a  well-known 
organization,  we  get  hit  with  a  lot 
of  spam.  The  day  I  installed 
SurfControl  E-mail  Filter,  4,000  messages  were  fil¬ 
tered  out  immediately.  My  users  really  like  the  end- 
user  spam  management  feature.  They  get  to  look  at 
their  own  mail  and  help  manage  the  system,  which 
reduces  the  time  I  spend  managing  the  product.  And 
before  SurfControl  Web  Filter,  we  had  no  way  to  track 
Internet  abuse  or  usage.  SurfControl's  reporting  is  a 
big  benefit  because  it  lets  me  track  these  activities. 
We've  also  seen  a  decrease  in  spyware." 

—Kevin  Craig,  IT  Director,  Richard  Petty  Driving 
Experience,  Concord,  N.C. 

Contact  information:  info@surfcontrol.com 

www.surfcontrol.com 

831-440-2500 


users’  computers,  can  be  used  remotely  at  any  time  to 
break  into  other  systems. 

•  Dialer  programs  that  can  be  used  to  change  local  dial-up 
Internet  service  provider  telephone  numbers  to  costly 
long-distance  numbers. 

Best  practices  for  dealing  with  spyware 

Here  are  some  techniques  for  protecting  your  company, 

computers  and  employees  from  spyware  and  adware: 

•  Teach  your  users  about  the  risks  associated  with  down¬ 
loading  adware,  shareware,  freeware  and  other  pro¬ 
grams  from  the  Internet.  Where  possible,  forbid  them 
from  doing  so. 


•  Train  high-risk  workers  to  recognize  signs  of  threats. 
You’ll  want  your  help-desk  staff,  for  instance,  to  be  able 
to  recognize  both  human  and  automated  attempts  to 
elicit  passwords. 

•  Develop  protections  for  gateways.  URL  filtering  can  be 
used  to  block  known  adware  sites;  download  filtering  can 
neutralize  adware  programs  and  reduce  their  bandwidth 
consumption. 

•  Boost  protections  for  clients.  Keep  in  mind  that  people 
accessing  your  network  remotely  won’t  be  affected  by 
gateway  controls.  Institute  protective  measures  such  as 
keeping  client  browser  software  patched  and  locking 
down  desktop  computers  so  that  new  applications  can’t 
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be  downloaded  unless  they’re  on  an  approved  list. 

•  Implement  two-factor  authentication — that  is,  two  ways  of 
determining  identity,  such  as  a  password  and  a  finger¬ 
print — especially  if  you’re  concerned  about  password  theft. 

•  Clean  up  desktop  systems  using  anti-spyware  tools  such  as 
those  from  Tokyo-based  Trend  Micro  and  Islandia,  N.Y.- 
based  Computer  Associates. 

Best  practices  for  deflecting  spam 

Make  no  mistake:  Spam  represents  a  genuine  security 
threat.  Unsolicited  junk  e-mail  blocks  the  availability  of 
resources  and,  when  it  carries  a  virus,  becomes  an  immedi¬ 
ate  danger  to  the  health  of  the  enterprise.  Following  are 
some  ways  to  reduce  the  flood  of  spam: 

•  Don't  list  e-mail  addresses  on  your  Web  site.  Use  a  fill-in- 
the-blanks  e-mail  form  or  a  graphic  image  of  an  e-mail 
address  with  no  HTML  code. 

•  Server-side  encode  your  e-mail  addresses.  You  can  avoid  dis¬ 
playing  e-mail  addresses  in  HTML  code  by  encasing  them 
in  a  server-side  encoder  that  generates  addresses  on  the  fly. 

•  Disguise  e-mail  addresses.  The  idea  is  to  fool  the  auto- 

\  mated  Web  spiders,  but  not  the  humans  who  are  looking 

for  addresses.  Thus,  jdoe@xyz.com  is  disguised  as 
jdoeDELETE@xyzTHIS.com. 

•  Use  less  obvious  e-mail  addresses.  Rather  than 
jdoe@xyz.com  or  some  similarly  rational  address  scheme 
using  variations  on  employee  names,  consider  making 
addresses  less  intuitive  to  thwart  brute-force  dictionary 
spamming. 

•  Use  e-mail  aliases.  Create  “front”  addresses  so  that  the 
real  e-mail  address  is  shielded  by  another  address — or 
even  several  addresses — on  which  you  place  filters  that 
admit  desired  e-mails  and  quarantine  or  delete  the  rest. 

•  Authenticate  incoming  e-mail.  One  prevailing  tech¬ 
nique  is  a  “challenge-response”  system  based  on  the 
philosophy  that  “good”  e-mail  comes  from  legitimate 
senders  that  are  on  your  approved  list.  With  such  solu¬ 
tions,  when  e-mail  comes  from  unapproved  sources, 
your  server  automatically  replies  with  a  message 
instructing  senders  to  confirm  their  identities.  Once 
they’ve  done  so,  they’re  added  to  your  list  and  their 
e-mails  are  accepted. 

•  Don’t  become  part  of  the  problem.  This  means  hardening 
your  hosts  and  servers  to  eliminate  vulnerabilities,  find¬ 
ing  and  getting  rid  of  spyware,  closing  open  relays  and,  of 
course,  carefully  controlling  access. 

In  addition,  products  such  as  the  Web  and  e-mail-fil¬ 
tering  solutions  from  SurfControl  pic,  which  is  based  in 
Cheshire,  England,  can  block  sites  that  host  spyware, 
software  download,  instant  messaging  and  other  poten¬ 
tial  threats.  CIC  SL 


NETWORKS  AND 

INFRASTRUCTURE 

Help  for  IT 

The  numbers  tell  it  all.  Fully  78  percent  of 
those  participating  in  the  2004  Computer 
Security  Institute/FBI  Computer  Crime  and 
Security  Survey  detected  virus  attacks  in  their 
corporate  networks,  while  nearly  40  percent  reported  intru¬ 
sions.  More  than  half  had  found  that  their  systems  had  been 
used  in  unauthorized  ways;  more  than  a  third  had  discov¬ 
ered  that  users  had  been  able  to  access  information  they 
weren’t  authorized  to  see. 

“The  reason  why  firewalls  exist  is  because  of  an  over¬ 
sight  in  the  design  of  the  first  generation  of  networked 
computers,”  says  Peng  Ong,  founder  and  CEO  of  Foster 
City,  Calif.-based  Encentuate  Inc.  “We  just  did  not  expect 
that  computers  would  be  connected  to  so  many  other 
computers,  and  we  did  not  design  them  with  sufficient 
security.  As  network  access  devices— such  as  PCs,  laptops, 
PDAs  and  phones — get  more  mobile,  the  traditional  way 
of  securing  them  by  putting  them  in  a  ‘secure’  environ¬ 
ment  has  become  unworkable.” 

While  it  seems  like  absolute  security  for  IT  networks 
and  infrastructures  remains  a  futuristic  idea,  welcome 
new  solutions  are  emerging  to  address  enterprise-wide 
security  needs. 

Integrating  threat  management 

Wherever  you  begin  in  your  quest  to  improve  enterprise 
information  security,  you’ll  eventually  find  yourself  consid¬ 
ering  narrowly  focused  point  solutions,  especially  if  they 
offer  leading-edge  capabilities.  And  so  you’ll  have  to  con¬ 
sider  the  pros  and  cons  in  this  version  of  the  age-old  debate 
between  the  virtues  of  point  versus  integrated  solutions. 

Certainly  the  arguments  for  integrating  threat  manage¬ 
ment  are  appealing: 

•  Too  often  information  security  and  physical  security  are 
separate,  uncoordinated  endeavors.  Physical  security 
issues — such  as  building  designs  offering  clear  sightlines, 
no  hidden  stairways,  and  so  on— tend  to  get  short  shrift. 

•  Point  solutions  handle  a  limited  set  of  tasks  that  too  often 
trigger  false  alarms,  may  not  reveal  larger  patterns  and  are 
difficult  and  costly  to  centrally  manage.  Intrusion-detec¬ 
tion  systems  (IDSs),  for  instance,  use  either  signature  files 
or  heuristics  to  predict  attacks,  but  are  too  often  wrong. 
Vulnerability-assessment  scanning  systems  spot  network 
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ill  I  ISACA 

Supporting  Sound 
IT  Practices 


STUDY 


Solution  Provider:  The  Information 
Systems  Audit  and  Control  Association® 
(ISACA®)  is  a  global  leader  in  IT  gover¬ 
nance,  control,  security  and  assurance.  ISACA  is 
dedicated  to  supporting  individuals  in  achieving 
high  levels  of  organizational  per¬ 
formance  and  conformance  through 
the  application  of  sound  information 
security,  IT  assurance  and  IT  man¬ 
agement  practices. 


Product  and  Service  Offerings: 

The  association  strives  to  provide  the 
elements  needed  by  any  growing  pro¬ 
fessional  discipline:  original  research,  practical  edu¬ 
cation,  career-enhancing  certification,  industry¬ 
leading  standards  and  best  practices,  a  network  of 
like-minded  colleagues,  professional  resources  and 
technical/managerial  publications.  ISACA  adminis¬ 
ters  the  globally  recognized  Certified  Information 
Systems  Auditor'  (CISA®)  and  Certified  Information 
Security  Manager®  (CISM®)  certifications.  The  asso¬ 
ciation  hosts  international  conferences  and  training 
events,  and  publishes  a  leading  technical  publica¬ 
tion,  the  Information  Systems  Control  Journal. 

ROI:  In  the  three  decades  since  its  inception,  ISACA 
has  become  a  pace-setting  global  organization. 

ISACA's  CISA  certification  has  been  earned  by  more 
than  38,000  professionals.  Its  CISM  certification 
uniquely  targets  the  information  security  manage¬ 


Information  Systems 
Audit  and  Control 
Association • 


ment  audience  and  was  recently  named  by 
Certification  magazine  as  one  of  the  top  10  new  certi¬ 
fications.  More  than  5,100  professionals  have  achieved 
the  CISM  designation,  and  CISM  continues  to  grow  in 
stature  and  influence. 

"The  business  market  has  become  truly 
global.  Management  and  control  over  IT 
transcend  geography,  and,  as  a  result, 
certifications  that  are  internationally 
recognized  are  critical  to  ensure  a  con¬ 
sistent  approach,  background  and  skill 
set,"  Marios  Damianides,  CISA,  CISM, 
and  a  partner  at  Ernst  &  Young  LLP,  told 
Certification  magazine  in  January  2004.  ISACA  pro¬ 
vides  that  consistency  in  IT  management  and  control 
not  only  with  its  global  certifications,  but  also  with 
its  highly  regarded  standards,  research,  educational 
opportunities  and  membership  program. 

Customers:  ISACA  recognizes  that  it  must  provide 
products,  services  and  benefits  to  the  wide  range  of 
IT  professionals  who  work  to  ensure  reliable  informa¬ 
tion  and  systems.  ISACA's  constituency  includes  IS 
auditors,  IT  security  managers,  academics,  consult¬ 
ants,  internal  auditors,  CIOs,  external  auditors,  CEOs 
and  a  host  of  others. 

Contact  information:  www.isaca.org 

info@isaca.org 

847-253-1545 


hosts  in  need  of  software  patches  but  tend  not  to  help 
administrators  figure  out  what  to  fix  first,  since  they  can’t 
incorporate  IDS  scans  and  predictions. 

Some  IT  security  solution  providers  are  addressing  these 
weaknesses  with  integrated  threat  management  solutions 
that  combine  key  elements  in  point  security  solutions. 

One  example:  Securify  Corp.  of  Cupertino,  Calif.,  whose 
solutions  address  overall  infrastructure  security.  Under 
Securify ’s  approach,  a  traffic-policy  engine  inspects  all  net¬ 
work  traffic,  classifying  it  as  either  good  or  bad  and  giving 
administrators  a  complete,  real-time  view  of  network-secu¬ 
rity  status.  This  information  is  then  integrated  with  IDS  and 


vulnerability  assessment  functionality  to  pick  up  on  attacks, 
anomalies  and  weaknesses. 

Updating  security  infrastructure 

Thanks  to  the  Internet,  old  approaches  to  enforcing  static 
network-security  perimeters  are  giving  way  to  newer, 
more  dynamic  ones.  Organizations  need  dynamic  infra¬ 
structures  able  to  automatically  enforce  security  policies 
enterprise-wide  by: 

•  Limiting  users  to  the  resources  they’re  authorized  to 
access.  This  policy  makes  it  easier  to  lessen  the  risk  of  data 
exposure  and  minimize  the  impact  of  attacks. 
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ADVERTISING  SUPPLEMENT 


Informing  your  non-IT  colleagues  about  the  risks 
of  poor  security  is  just  as  important  as  keeping 
your  own  staff  up-to-date  on  the  subject. 


•  Continually  monitoring  traffic  for  both  policy  violations 
and  threats.  This  practice  makes  it  simpler  and  less  costly 
to  sustain  business  continuity  because  threats  can  be 
more  quickly  spotted,  contained  and  addressed. 

•  Screening  devices  and  users.  That  means  verifying  creden¬ 
tials  and  scanning  devices  for  policy  and  configuration 
compliance  as  well  as  the  presence  of  threats  (such  as 
viruses)  before  granting  access. 

Currently,  several  initiatives  aiming  to  build  solutions 
that  screen  devices  and  granularly  enforce  security  policies 
are  in  various  stages  of  development.  These  include  Cisco’s 
Network  Admission  Control  (NAC)  access  management, 
Microsoft’s  Network  Access  Protection  (NAP),  and  the 
Trusted  Computing  Network  (TNC),  from  an  industry 
alliance — the  Trusted  Computing  Group — that  includes 
such  vendors  as  Symantec,  Trend  Micro,  Network 
Associates,  and  Juniper  Networks. 

Meanwhile,  companies  such  as  San  Francisco-based 
Vernier  Networks,  offer  network  access-management  appli¬ 
ances  that  complement  firewalls  and  can  be  deployed  at  the 
network  edge. 

Incorporating  encryption 

Regardless  of  the  kind  of  network  you  operate,  encryption 
technology  can  help  you  stave  off  network  attacks,  espe¬ 
cially  when  used  in  concert  with  strong  authentication,  fire¬ 
wall,  intrusion  detection  and  security-assessment 
technologies. 

It’s  true  that  even  encrypted  information  can  be  cap¬ 
tured  by  attackers.  But  actually  deciphering  that  informa¬ 
tion  requires  the  right  encryption  key.  In  addition, 
crypto-based  authentication  typically  frustrates  hijackers 
because  the  data  being  illicitly  inserted  can’t  be  properly 
authenticated. 

You  can  strengthen  security  by  injecting  encryption  into 
multiple  network  layers  or  adding  it  to  hosts,  switches  and 
so  on.  To  maximize  security  at  the  links  between  your  cor¬ 
porate  systems  and  your  network  access  points,  you  can 
implement  encryption  safeguards  so  that  information  is 
secured  before  it  gets  sent  out  onto  the  open  Internet  or 
into  a  partner’s  intranet. 

Encryption  solutions  provider  Safe  Net  Inc.  of  Belknap, 
Md.,  recommends  taking  the  following  steps  to  minimize 
encryption  deployment  risk  and  cost: 

•  Opt  for  federally-endorsed  (NIST,  ANSI)  security 


strength,  such  as  Triple-DES. 

•  Integrate  public  key  infrastructure  (PKI)  technology  for 
strong  authentication  and  digital  certificates. 

•  Plan  scalable  network  and  security  management  systems  if 
your  enterprise  runs  large  networks  with  thousands  of  nodes 

•  Use  carriers  that  offer  a  secure  ATM  or  frame-relay  public 
data  network  service. 

•  Build  solutions  that  integrate  ATM  or  frame-relay  with  IP 
solutions  to  ensure  that  your  security  policy  evolves  in 
response  to  your  business  needs. 

Staying  on  track 

The  daily  bombardment  of  new  threats  and  vulnerabili¬ 
ties — a  new  virus,  another  round  of  “phishing,”  spyware¬ 
laden  spam  attacks — can  drive  CIOs  and  their  staffs  to 
distraction.  So  it’s  important  to  maintain  your  focus  on 
what  matters  most. 

“We  desperately  need  to  pay  more  attention  to  assessing 
risk  and  vulnerability,  and  measuring  security,”  says  Phebe 
Waterfield,  CISSP,  senior  analyst  for  The  Yankee  Group,  the 
Boston-based  research  and  consulting  firm.  “We  cannot 
manage  what  we  cannot  measure.” 

Informing  your  non-IT  colleagues  about  the  risks  of 
poor  security  is  just  as  important  as  keeping  your  own  IT 
staff  up-to-date  on  the  subject.  “Once  non-IT  managers 
and  staff  are  educated  about  security,  they  become  much 
more  effective  at  identifying  security  risks  in  their  own 
processes  and  projects,”  observes  Betty  Johnson,  vice  presi¬ 
dent  of  information  technology  at  The  Nonprofits 
Insurance  Alliance  Group  of  Companies,  which  provides 
liability  insurance  for  charitable  nonprofit  organizations. 

Annual  security  audits  and  penetration  testing  con¬ 
ducted  by  outsiders  can  also  help  stave  off  disaster.  “This 
testing  validates  existing  security  controls,  exposes  secu¬ 
rity  weaknesses  and  offers  the  opportunity  for  immediate 
remediation,”  Johnson  points  out.  “Choose  a  vendor  that 
is  a  recognized  leader  in  the  field  of  security  testing.  And 
take  the  time  to  perform  due  diligence- — -that  is,  research 
scope,  check  references  and  so  on,  before  initiating  a  serv¬ 
ice  agreement.” 

Above  all,  be  honest.  Don’t  try  to  skirt  the  real  issues  reg¬ 
ulators  are  targeting:  privacy,  identity  theft  and  fraud.  Says 
Waterfield:  “It’s  tempting  to  aim  to  pass  the  audit  with  as 
little  effort  and  cost  as  possible — but  it’s  important  to  tackle 
the  issue  with  ethics  and  integrity.”  CIOSL 
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ITGI 


Ensuring  Effective  IT  Governance 


Solution  Provider:  The  IT  Governance  Institute 
(ITGI)  was  established  in  1998  to  advance  interna¬ 
tional  thinking  and  standards  in  directing  and  con¬ 
trolling  information  technology.  By  hosting  confer¬ 
ences  and  offering  original  research  and  case  studies, 
ITGI  assists  enterprise  leaders  and  boards  of  directors 
in  their  responsibilities  regarding  IT  governance.  ITGI 
helps  ensure  that  IT  is  aligned  with  business  objec¬ 
tives,  delivers  value,  is  measured,  miti¬ 
gates  risks  and  is  properly  allocated. 


Product  and  Service  Offerings:  To 
provide  guidance  to  organizations  of  all 
sizes  and  industries  around  the  world, 

ITGI  developed  Control  Objectives  for 
Information  and  related  Technology 
(COBIT),  the  internationally  accepted  framework  for 
control  over  information,  IT  and  related  risks.  Other 
ITGI  publications  include: 

•  COBIT  Security  Baseline 

•  Board  Briefing  on  IT  Governance ,  2nd  Edition 
•Information  Security  Governance 

•IT  Control  Objectives  for  Sarbanes-Oxley 
•IT  Governance  Implementation  Guide 

ROI:  According  to  the  IT  Governance  Global  Status 
Report,  more  than  91  percent  of  executives  recognize 
that  IT  is  vital  to  the  success  of  their  businesses— but 
more  than  two-thirds  of  CEOs  aren't  comfortable 
answering  questions  about  governance  and  control 
over  their  IT  processes.  That's  the  case  despite  the 
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impact  of  the  Sarbanes-Oxley  act  and  increased 
scrutiny  worldwide  focusing  attention  on  the  IT 
processes  that  underlie  financial  systems. 

According  to  the  Global  Status  Report,  companies 
that  place  IT  on  the  board  agenda  reported: 

•  Better  measurement  of  IT  performance 

•  Better  management  of  risk  and  IT  resources 

•  Better  delivery  of  business  value 
through  IT 

•  Better  alignment  of  IT  with  company 
strategy 


Governance 

Institute® 


Customers:  IT  governance  activities  are 
implemented  by  international  businesses, 
government  entities  and  other  organiza¬ 
tions.  Case  studies  focusing  on  specific  implementa¬ 
tions  are  available  at  www.itgi.org.  Organizations 
profiled  include: 

•Allstate  Corp. 

•  Charles  Schwab  &  Company 

•  Ernst  &  Young  AG/Switzerland 

•  Datasec,  Uruguay 

•  U.S.  House  of  Representatives 

•  Mendoza,  Argentina 

•Curtin  University  of  Technology,  Australia 

•  City  of  Mesa,  Arizona 

Contact  information:  info@itgi.org 

www.itgi.org 

847-590-7491 
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\  W  •  Vernier  Networks  Inc. 

\//"N  K  A  |  /*N  Y  SeanGavin 

T  1  I  I  I  I  info@verniernetworks.com 

Workshare 

^r-m  sales.us@workshare.com 

Workshare  phone:  i-888-404-4246 

NETWORKS  Phone:  650-526-2600 

or  415-975-9855 

or  866-VERNIER 

Fax:  415-975-3854 

Fax: 650-526-2601 

www.workshare.com 

www.verniernetworks.com 

Workshare  Protect  provides  policy-enforced  document  security  for 

Vernier  Networks  offers  the  industry's  only  clientless  network  access 

Microsoft  Office.  Ensure  that  your  organization  is  secure  from  the  embar¬ 

management  products  that  enable  enterprises  to  assure  business  conti¬ 

rassment,  financial  risk,  and  liability  of  confidential  information  leaks. 

nuity.  Vernier's  EdgeWall™  security  appliance  provides  comprehensive 

Safeguard  your  organization  with  Workshare  Protect-the  industry-leading 

network  access  management  to  defend  against  attacks  on  the  network  by 

document  security  application  for  Microsoft  Office  documents. 

screening  users  and  devices,  restricting  access,  inspecting  traffic  for 

Features  include  automated  PDF  creation,  document  rights  over  e-mail, 

worms  and  viruses,  and  enforcing  policy. 

and  fast,  non-disruptive  delivery  of  secure  email  attachments. 
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Budget  size,  business  goals,  privacy  needs,  regulatory  pressures. .  .no  matter  how  these  may  vary  from  organization 
to  organization,  certain  concerns  remain  common  to  CIOs:  How  do  I  get  more  value  from  my  IT  investment? 

How  can  I  ensure  that  my  resources  are  used  to  maximum  benefit?  How  can  I  be  certain  that  my  risks  are  managed? 

You  have  questions.  We  have  answers. 

The  IT  Governance  Institute,  a  global  leader  in  IT  governance  research,  was  established  to  assist  enterprise  leaders 
in  their  responsibility  to  make  IT  successful  in  supporting  the  enterprise’s  mission  and  goals,  and  its  risks  are 
mitigated.  Among  our  offerings: 


■  Control  Objectives  for  Information  and  related  Technology  (CobiT®)  3rd  Edition  Management  Guidelines , 
which  provides  key  goal  indicators,  key  performance  indicators,  critical  success  factors  and  maturity  models 
for  evaluating  the  enterprise’s  IT 


■  IT  Control  Objectives  for  Sarbanes-Oxley,  offering  a  road  map  for  compliance  with 
this  critical  legislation 

■  Board  Briefing  on  IT  Governance,  2nd  Edition ,  outlining  definitions,  best  practices, 
roles  and  responsibilities  for  IT  governance 

■  IT  Governance  Global  Status  Report ,  revealing  global  attitudes  toward  IT  problems 
and  solutions 

Replace  concerns  with  solutions. 

Find  out  more  at  WWW.itgi.org 
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Governance,  Control 
and  Related  Technoloo 
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GOVERNANCE  3701  Algonquin  Road,  Suite  1010,  Rolling  Meadows,  IL  60008  USA 
INSTITUTE®  Phone: +1.847.590.1491  Fax: +1.847.253.1443  E-mail:  info@itgi.org 


CIO  ENTERPRISE 
VALUE  AWARDS 


The  Resource  for 
Information  Executives 


As  an  executive  who  has  built  or  conceived  an  IT  system 
that  delivers  both  demonstrable  ROI  and  strategic  value  to 
your  organization,  you  deserve  recognition  and  praise. 

Now  in  its  14th  year,  the  CIO  Enterprise  Value  Award  will 
bring  you,  your  company  and  your  IT  organization  the 
industry  prestige  you  deserve. 


Download  the  application 
from  our  website  at 

www.cio.com/eva 

or  contact  Lynne  Rigolini 
at  508-935-4088. 

Deadline  for  entry: 

April  15,  2005 


Organizational  Change 


The  Five  Facets  of  Every  Organization 

How  to  use  a  “systems  thinking’’  framework  for  leading  change 

Underlying  the  organizational  change  effort  at  Assemblies  of  God  (AG)  headquarters  is 
a  model  from  systems  thinking,  a  theoretical  approach  to  analyzing  how  interactions 
between  parts  of  an  entity  affect  overall  performance.  Dean  Meyer,  the  organizational 
consultant  retained  by  AG,  uses  a  five-part  systems  thinking  model.  A  tenet  of  systems 
thinking  is  that  an  organization’s  parts  must  be  in  balance.  A  weakness  in  one  area  can 
throw  off  performance,  even  if  the  other  areas  function  well. 
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Culture: 

an 

organization’s 

behavioral 

patterns 

Structure: 

job  functions, 
reporting 
relationships 
and  workflows 

Internal 

economy: 

budgeting  and 
other  resource 
management 

Methods 
and  tools: 

procedures, 
skills  and  tools 
that  people  use 

Metrics  and 
rewards: 

incentives  for 
performance 

sales  cover  65  percent  of  the  headquarters’ 
operating  expenses,  that  was  a  problem. 

A  ROAD  MAP  FOR 
TRANSFORMATION 

The  1,100-person  staff  at  AG  headquarters  is 
brimming  with  passionate,  well-intentioned 
people,  many  of  whom  took  pay  cuts  to  work 
there.  (The  fact  that  Strathdee  has  been  there 
nearly  28  years  doesn’t  raise  an  eyebrow.) 
Yet,  a  stovepipe  mentality  (“kingdom-build¬ 
ing”  in  AG  terminology)  was  crippling  the 
organization’s  ability  to  respond  to  the  busi¬ 
ness  challenges  it  faced.  “People  did  not  talk 
to  each  other,”  says  Harold  Sallee,  assistant 
to  the  general  superintendent.  “I  don’t  mean 
they  didn’t  trust  each  other.  They  were  so 
passionate  about  what  they  were  doing,  they 
just  went  along  and  did  it.” 

Communication  suffered;  duplication  of 
efforts  (including  multiple  purchasing 
functions  and  editorial  groups)  was  ram¬ 
pant.  The  cost-plus  budgeting  process, 
which  many  managers  delegated  to  their 
subordinates,  exacerbated  the  problem, 
since  there  was  no  mechanism  to  review 
whether  existing  programs  were  worth 
sustaining.  Once  funded,  most  programs 
were  simply  continued. 

Frustrated  by  his  inability  to  climb  out 
of  the  maintenance  trap  and  meet  requests 
to  fund  new  development,  Strathdee  called 
Meyer,  author  of  the  activity-based  costing 
tract  that  had  piqued  his  curiosity.  But  the 
conversation  surprised  him.  After  Strathdee 
described  AG’s  broken  budgeting  process, 
Meyer  quickly  (and  correctly)  surmised  that 
there  were  deeper  issues:  The  organization 
was  stuck  in  maintenance  mode,  even  flirt¬ 
ing  with  irrelevance.  He  suggested  that  AG 
step  back  and  look  at  these  larger  problems. 

The  organization  was,  in  fact,  attempting 
to  do  just  that.  Trask  had  launched  a  Vision 
for  Transformation  (VFT)  effort  in  1998. 
After  AG  churches  arrived  at  a  common 
spiritual  vision  for  the  church,  the  VFT 
focus  turned  to  a  review  of  headquarters’ 
operations  in  spring  2002.  The  review  com¬ 
mittee  “met,  and  frankly,  we  didn’t  know 
where  to  start,”  says  Strathdee,  a  committee 
member.  “So  we  just  scheduled  another 
meeting  for  later.”  But  after  his  conversa¬ 
tion  with  Meyer,  Strathdee  introduced 
Trask  and  other  top  executives  to  Meyer’s 


RoadMap  process.  They  soon  decided  it  was 
the  blueprint  for  VFT. 

Meyer’s  RoadMap  is  a  diagnostic  based 
on  systems  thinking  (see  “The  Five  Facets  of 
Every  Organization,”  this  page).  The  Road- 
Map  helps  organizations  document  a  clear 
vision,  analyze  the  gaps  between  vision  and 
reality,  diagnose  the  root  cause  of  problems 
and  then  outline  a  leadership  plan  to 
achieve  the  desired  outcome.  By  January 
2003,  Meyer  had  signed  on  as  a  consultant, 
and  the  VFT  committee  had  changed  its 
name  to  the  RoadMap  Process. 

A  VFT  design  team,  comprising  42  man¬ 
agers  from  all  functions  within  the  organi¬ 
zation,  began  by  soliciting  input  from 
employees  on  how  headquarters  operated. 
Just  over  half,  about  600,  participated  at  sev¬ 
eral  gatherings  that  spring,  which  Sallee 
characterizes  as  “good  venting  sessions.” 
Breakout  sessions  on  hot  topics  allowed  for 
deeper  discussions,  and  every  single  com¬ 
ment  was  documented  on  a  Post-it  note. 
Sallee  would  later  invite  employees  to  e-mail 
their  concerns  to  culture@ag.org.  He  says  the 
first  batch  of  e-mails  was  “vindictive  and 
hurtful,”  but  employees  toned  it  down  after 
he  asked  for  more  constructive  criticism. 

The  design  team  reviewed  all  comments, 
pulling  from  them  five  particular  trouble 
spots:  partnership  with  customers  (both 
internal  and  external),  resource  management, 
product  design,  operational  services  and  peo¬ 
ple  management.  They  mapped  every  Post-it 
note  to  one  of  the  challenge  areas. 

Meyer  led  the  design  team  in  a  root-cause 


analysis.  One  thing  jumped  out  most  of  all 
from  the  Post-it  notes:  AG’s  organizational 
culture  was  holding  it  back.  “The  people 
there  are  very,  very  sincere.  They  felt  called 
there  to  run  their  ministries,”  explains 
Meyer  (who  is  not  a  member  of  the  AG 
faith).  “But  since  they  were  called,  they  felt 
it  was  up  to  them  to  sort  out  what  to  do  as 
opposed  to  serving  customers  who’d  tell 
them  what  they  wanted.” 

Ironically,  the  extreme  cordiality  of  the 
staff  (a.k.a.  Midwest  Polite)  was  part  of  the 
problem.  “Sometimes  being  polite  to  one 
another  can  be  detrimental,”  Meyer  says. 
“Organizations  may  avoid  conflict  to  the  point 
of  not  resolving  issues,  or  will  even  tolerate 
ambiguity  and  go  their  separate  ways.”  So 
instead  of  a  culture  of  teamwork,  there  was 
too  much  kingdom-building  and  too  little 
communication,  often  resulting  in  duplica¬ 
tion  of  efforts  and  inefficient  use  of  resources. 

In  the  fall  of  2003,  the  design  team 
decided  to  focus  on  transforming  the  orga¬ 
nizational  culture  and  structure.  The  goal 
was  to  revamp  AG’s  internal  structure  to 
match  its  external  goals.  A  parallel  effort  to 
improve  AG’s  resource  allocation  methods 
addressed  the  shortcomings  of  the  cost-plus 
budget  process  by  initiating  Meyer’s  version 
of  activity-based  costing. 

ORGANIZING  CULTURE 
AND  STRUCTURE  FOR 
TEAMWORK 

Strathdee  says  the  RoadMap  team  was  nerv¬ 
ous  at  first  about  a  cultural  makeover,  because 
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MIDDLEWARE  IS  IBM  SOFTWARE.  The  powerful  DB2 
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information  management  solution  available.  Built  on  open 
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Organizational  Change 


it’s  hard  to  change  people’s  feelings  and  opin¬ 
ions.  But  Meyer  encouraged  them  to  focus  on 
behaviors  rather  than  attitudes.  “When  we 
thought  of  culture  as  behaviors,  we  thought, 
We  can  address  this,”  Strathdee  recalls. 

The  team  worked  its  way  through  a  list 
Meyer  compiled  of  13  cultural  principles  com¬ 
mon  to  effective  organizations,  including 
good  interpersonal  relationships,  integrity, 
teamwork  and  making  commitments  that  can 
be  kept.  They  modified  them  to  align  with 
AG  values.  (Instead  of  respecting  the  devil’s 
advocate,  for  example,  the  AG  version  rec¬ 


ognizes  “those  presenting  contrary  views.”) 
The  resulting  42-page  document,  which  is 
interspersed  with  supporting  biblical  quo 
tations,  outlines  specific  behaviors  that  are 
expected  of  all  AG  employees. 

That  kind  of  cumbersome  document  Is 
hard  to  read  to  the  end,  much  less  inculcate 
into  an  organization.  But  in  AG’s  case,  a 
teaching  team  rolled  out  each  principle  in 
mandatory  one-hour  sessions  every  three 
weeks.  By  November  2004,  the  culture 
change  rollout  was  complete,  and  Strathdee 
and  his  colleagues  were  already  pointing 
to  benefits,  such  as  more  productive  meet¬ 
ings  and  better  communication  among 
managers. 

Sallee  says  one  major  impact  of  the  cul¬ 
ture  effort  is  that  AG’s  executive  suite  is 
more  open  to  dialogue.  “We’ve  always  had 
an  open-door  policy,  but  people  now  feel 
like  they  can  really  go  to  that  open  door,”  he 
says.  At  the  Gospel  Publishing  House,  the 
new  atmosphere  of  teamwork  has  made  it 
possible  to  roll  out  new  products,  such  as  a 
Christian  comic  book  line  and  a  sports  camp 
curriculum,  in  record  time. 

A  subcommittee  on  organizational  struc¬ 
ture,  charged  with  recommending  an  ideal 
structure  for  AG  and  reviewing  its  work¬ 


flows,  began  meeting  in  early  2004.  After 
studying  Meyer’s  building  blocks  for  organ¬ 
izations,  the  committee  proposed  a  new 
configuration  for  the  top  reporting  rela¬ 
tionships  at  AG. 

Enterprisewide  structural  changes  have 
yet  to  be  made,  but  Strathdee  has  already 
applied  some  of  Meyer’s  advice  within  the 
IT  group.  Meyer  recommends  coordinating 
around  specialties  instead  of  around  prod¬ 
ucts;  Strathdee  separated  network  services 
personnel  (engineers  and  architects  respon¬ 
sible  for  innovation)  from  operations  cen¬ 


ter  staff  (charged  with  maintaining  the 
system  that  automates  the  warehouse  and 
shipping  processes).  “When  you  group  peo¬ 
ple  by  specialty,  their  stress  level  goes 
down,”  says  Strathdee.  “You  can’t  ask  a  per¬ 
son  to  innovate  and  make  sure  the  network 
never  goes  down. 

BUDGETING  FOR 
VALUE 

The  concept  underlying  activity-based  cost¬ 
ing  is  straightforward:  Desired  outcomes 
and  deliverables  are  quantified  and  listed 
on  the  budget.  AG  kicked  off  the  effort  to  dis¬ 
card  its  old  cost-plus  budgeting  mentality 
in  January  2004,  when  Gospel  Publishing 
House  adopted  Meyer’s  Budget-by-Deliver- 
ables  (BBD)  approach.  For  the  2006  fiscal 
year  budget,  more  than  half  of  the  AG  head¬ 
quarters  will  be  using  BBD,  which  builds 
budgets  based  on  the  cost  of  specific  deliv¬ 
erables  as  opposed  to  traditional  line  items 
such  as  travel  or  training,  says  Clyde 
Hawkins,  administrator  of  AG’s  Division  of 
the  Treasury. 

Strathdee  already  sees  a  difference  in  the 
budgeting  process.  Managers  are  proac¬ 
tively  calling  him  about  their  plans  for  the 
coming  year  so  that  he  can  factor  in  new 


development  costs  as  he’s  preparing  his 
budget,  he  says.  “This  year,  for  the  first  time, 
I  actually  have  some  venture  items  in  my 
budget  that  are  not  based  on  the  last  12 
months,  but  based  on  things  that  depart¬ 
ments  want  to  do.” 

A  portion  of  everyone’s  salary  will  ulti¬ 
mately  be  determined  by  deliverables,  giv¬ 
ing  managers  a  strong  incentive  to  look  more 
carefully  at  how  their  employees  are  spend¬ 
ing  their  time,  Strathdee  says.  Working 
through  a  BBD  worksheet  led  him  to  con¬ 
clude  that  he  needs  102  IT  employees.  (He’s 
now  got  94.)  He  can  see  precisely  which 
deliverables  are  stretching  his  staff;  two 
more  programmers  were  recently  added  to 
the  current  18,  for  example. 

After  identifying  deliverables  and  the 
resources  needed  to  deliver  them, 
Strathdee’s  next  step  was  to  “sell”  those 
allocations  to  departments  at  a  budget  pri¬ 
oritization  m  eeting  in  early  January.  “I  went 
into  the  meeting  with  a  lot  of  apprehension 
about  defending  our  charges  [for  IT  serv¬ 
ices],  but  that  isn’t  how  the  meeting  went  at 
all,”  he  says.  Not  only  did  managers  pur¬ 
chase  all  of  the  IT  deliverables  offered  but 
some  found  out  about  services  that  IT  had 
been  providing  to  other  departments  and 
wanted  to  buy  them. 

“Our  ultimate  goal  is  to  have  a  scenario 
where  managers  can  have  some  choice  in 
what  services  they  are  buying  from  us,”  he 
says.  Departments  should  be  able  to  get 
nightly  backup  of  sensitive  corporate  data 
on  a  remote  desktop,  for  example,  as  long  as 
they’re  willing  to  pay  a  premium.  Strathdee 
knows  that  making  people  accountable  for 
the  costs  of  the  services  they  use  will  encour¬ 
age  thriftiness. 

Sallee  says  the  new  budget  process  will 
lead  to  major  cost  savings.  But  that’s  not  the 
biggest  benefit  from  AG’s  organizational 
revamp.  “The  most  important  thing  is  that 
10  to  12  of  the  key  managers  will  sit  down 
and  develop  priorities.  We’ll  have  more 
meaningful,  open  dialogue,  but  it  will  be  col¬ 
lective  rather  than  individual,”  Sallee  says. 
And  for  an  organization  once  known  for 
kingdom-building,  a  collaborative  approach 
is  something  of  a  miracle.  H0 


Senior  Editor  Alice  Dragoon  can  be  reached  at 
adragoon@cio.com. 


“This  year,  for  the  first  time,  I  have  some 
venture  items  in  my  budget  that  are  not 
based  on  the  last  12  months,  but  on 

things  that  departments  want  to  do.” 

-TIM  STRATHDEE,  CIO, 
ASSEMBLIES  OF  GOD  HEADQUARTERS 
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MIDDLEWARE  IS  IBM  SOFTWARE.  The  IBM 

TotalStorage®  Open  Software  Family.  It  automatically 
helps  manage  and  optimize  highly  complex  storage 
environments.  By  centralizing  information.  By  fully  utilizing 
resources.  By  simplifying  data  compliance.  Help  slash 
long-term  storage  costs.  On  demand.  Comprehensive, 
reliable  storage  management  solutions  from  IBM. 


1.  Statistics  from  Asia  retrieved  quickly. 

2.  Paris  client’s  portfolio  accessed  securely. 

3.  Critical  information  archived  automatically. 

4.  Data  kept  within  compliance  guidelines. 

5.  Optimized  storage  supports  heavy  volume. 


Middleware  for  the  on  demand  world.  Learn  more  at  ibm.com/middleware/resource  JjJJj  DEMAND  BUSINESS 
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Middleware  is  Everywhere. 

Can  you  see  it? 
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j;o«,  but  you  still  have  to  know  the  (unwritten) 
rules  of  the  game 


BY  THOM 


WAI 


Or,  you  may  stink  up  the*  course  every  time  you  put 
on  your  soft  spikes. 

But  one  thing  is  certain:  Golf  outings  are  as  integral 
to  corporate  life  as  board  meetings,  annual  reviews 
and  holiday  parties.  And  if  CIOs  want  to  play  along, 
they  have  to  know  the  subtle  points  of  the  game— not 
necessarily  the  rules  or  basic  playing  techniques  but 
how  to  behave  on  the  course  and  avoid  perpetrating 
the  cardinal  sins  of  golfing  etiquette. 

Among  the  most  egregious  missteps:  There's  lying, 
of  course.  People  lie  about  their  scores;  they  lie  about 
their  handicaps;  they  lie  about  their  lies. 

There's  rudeness— such  as  moving  when  someone 
is  teeing  off,  talking  when  someone  is  about  to  swing 
or  casting  your  shadow  where  someone  is  putting. 

There  are  errors  of  omission:  failing  to  rake  sand 
traps,  fix  ball  marks  on  the  green  or  replace  divots  in 
the  fairway. 

In  fact,  that  serene  golf  course  can  actually  be  a 
minefield  where  CIO  careers  can  be  made  or  broken  if 
you  happen  to  believe— as  many  golfers  do— that  the 
sport  reveals  a  person's  true  character.  "Golf  tells 


no  lies,"  says  Suzanne  Woo,  founder  of  BizGolf 
Dynamics,  a  company  that  helps  executives  better 
understand  the  nuances  of  the  game.  Golf,  she  says, 
"puts  you  under  this  weird  pressure  and  expecta¬ 
tions— and  in  this  competitive  mode." 

In  such  a  pressure  cooker,  CIOs  need  to  be  prepared 
for  all  types  of  situations  on  the  links— including 
strategies  for  dealing  with  a  cheating  CEO  who's  giv¬ 
ing  you  the  nod  and  wink,  or  a  pushy  vendor  who 
wants  to  monopolize  the  conversation  with  talk  of 
business.  "You  learn  more  about  a  person  in  four 
hours  on  the  golf  course  than  you  can  possibly  learn 
by  only  having  business  meetings,"  says  David 
Guzman,  the  former  CIO  of  Owens  &  Minor  who's  now 
chief  research  officer  of  The  Yankee  Group.  "No  mat¬ 
ter  how  you  try  to  be  on  your  best  behavior,  your  true 
personality  will  emerge  on  the  golf  course."  But  CIOs 
need  to  watch  themselves  as  well.  They  are  represen¬ 
tatives  of  their  companies,  and  any  unprofessional 
behavior  could  kill  future  business  deals  or  crimp 
their  career  plans.  "If  you  are  acting  like  a  buffoon  or 
cheating,  the  word  will  get  out,"  says  Woo.  "And  it 
won't  bode  well  for  you  or  your  company." 
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First  Things  First 

Among  business  golfers,  the  most  debated 
topic  is  whether  or  not  players  should  even 
talk  business.  CIOs  and  business  golf  experts 
advise  to  leave  that  up  to  the  other  people  in 
your  foursome— whether  it’s  a  vendor  sales¬ 
person,  your  boss,  your  biggest  customer  or 
your  CEO.  “Your  customer  may  use  the  golf 
course  to  ask  you  a  question  that’s  very 
important  to  him,  and  which  is  equally 
important  for  you  not  to  fumble,”  Guzman 
says.  Of  course  CIOs  should  answer,  but  they 
should  keep  it  short.  “Even  when  given  such 
an  opening,  do  not  use  it  to  drive  a  Mack 
truck  of  business  through  it,”  Guzman  says. 
“Simply  answer  the  questions  and  go  imme¬ 
diately  back  to  the  casual  camaraderie.” 

Expectations 

Management 

A  little  bit  of  communication  before  a  round 
can  help  CIOs  set  and  manage  the  group’s 
expectations  for  the  day.  Whether  you  are  the 
host  or  the  guest,  make  sure  you  find  out  about 
the  expectations  and  abilities  of  the  others  in 
your  group  before  you  head  out  to  the  first  tee. 
What  are  their  handicaps?  Do  they  even  have 
one?  Are  they  serious  about  their  games?  Or  do 
they  consider  themselves  perennial  duffers 
who  just  like  the  outdoors?  If  CIOs  are  more 
interested  in  “shooting  a  number”  (golfspeak 
for  serious  playing)  than  hearing  about  a  ven¬ 
dor’s  latest  product  release,  they  need  to  make 
that  clear  up  front.  “If  the  sales  guy  hits  with  a 


pitch  on  the  first  hole,  it’s  fine  for  CIOs  to  be 
able  to  say,  ‘Let’s  focus  on  golf,  and  we’ll  talk 
business  at  the  19th  hole,”’  says  Woo,  referring 
to  the  watering  hole  at  the  clubhouse.  And  a 
good  salesperson  should  always  accommodate 
his  CIO  guest.  “It’s  not  rocket  science,”  says 
David  Collins,  a  PGA  professional  and  owner 
of  The  Business  Golf  Academy,  a  company  that 
helps  salespeople  interact  better  with  clients 
on  the  golf  course.  “If  all  the  sales  guy  wants  to 
do  is  talk  business,  that’s  not  a  good  sign  [for 
the  CIO].” 

Playing  with  the  Boss 

A  CIO  who  is  invited  out  for  a  day  on  the 
links  by  the  CEO,  CFO  or  other  senior  exec¬ 
utive  had  better  be  prepared  for  anything. 
After  all,  those  executives  may  be  thinking 
about  about  promoting  him  or  testing  his 
psychological  makeup,  or  maybe  they  simply 
want  to  get  to  know  him  better.  “If  you’re  ever 
invited  to  go  and  play  with  the  boss,  it’s  a  job 
interview,”  says  Roger  Ham,  former  CIO  of 
the  Los  Angeles  Police  Department  and  a 
veteran  of  many  corporate  and  business  out¬ 
ings.  “That  three-foot  putt  is  the  longest  yard 
in  business,  and  it  will  show  them  your 
skills,  your  tenacity,  whether  you  have  good 
sportsmanship,  and  whether  you  can  lose 
with  grace  and  win  with  grace.” 

An  old  golf  adage  says  that  golf  matches 
are  won  and  lost  on  the  first  tee.  Translation: 
Perceptions  are  everything  on  the  golf 
course,  and  CIOs  need  to  be  aware  of  their 


body  language— whether  you’re  having  the 
best  or  worst  day  of  your  life.  “You  do  form 
opinions  of  people  on  the  course,”  says  Guz¬ 
man.  “Are  they  confident  and  comfortable 
with  themselves?  Are  they  extraordinarily 
nervous  or  calm  in  a  stressful  situation?  Are 
they  too  hard  on  themselves?” 

One  thing  business  golf  experts  universally 
advise  against  is  tanking  a  match  in  an  effort 
to  land  in  your  boss’s  good  graces.  “If  you  get 
caught  throwing  the  game,  it  will  be  more 
embarrassing  to  yourself  and  more  career¬ 
damaging,”  says  Bill  Storer,  president  of  Busi¬ 
ness  Golf  Strategies,  a  company  that  sets  up 
golf  outings  and  seminars  for  businesspeople. 
“You  ought  to  be  worried  about  what  your 
CEO  is  thinking  at  all  times.”  Besides,  Storer 
adds,  if  you  are  a  great  golfer,  most  people 
would  want  to  play  with  you  and  see  you  score 
well— as  long  as  you’re  humble  about  it. 


How  to  Respect  the  Game 

Course  manners  are  just  as  important  as  the  basic  rules.  Here  are  10  points  of  etiquette 
that  apply  from  tee  to  green. 

4  ' 

Never  talk  while  a  fellow  player  is  teeing  off.  2  Take  only  one  practice  swing  in  the 
tee  box.  3  Remain  in  the  tee  box  until  everyone  in  the  foursome  has  teed  off.  4  Always 
replace  your  divots  in  the  fairway.  S  Don't  slam  your  club  into  the  ground.  6  Be  ready 
to  play  at  all  times  Ca.k.a.  play  "ready  golf"].  7  Rake  the  sand  trap  after  every  bunker 
shot.  8  Fix  your  ball  mark  on  the  green.  9  Don't  walk  or  cast  a  shadow  in  another  player's 
putting  line.  lO  Pick  up  your  ball  for  the  hole  once  you  have  reached  double  bogey,  -t.w. 
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How  Japan  helps  Cisco  Systems 

spin  a  stronger  web 


No  wonder  Cisco  Systems,  the  preeminent 
player  paving  the  information  superhighway,  just 
opened  an  R&D  center  in  Tokyo.  With  broadband 
access  accelerating  and  traffic  five  times  heavier 
on  many  ISP  networks  than  that  carried  by  U.S. 
providers,  Japan  is  where  the  future  of  global 
Internet  growth  is  already  happening. 

Not  only  has  a  government-led  "e-Japan"  initiative 
successfully  incentivized  rapid  broadband  deployment — 
Japan,  as  one  of  most  sophisticated  broadband  markets, 
is  set  to  generate  many  of  the  world's  best  new  business 
models.  Technologies  perfected  here  satisfy  the  most  rigorous 
standards,  so  they  offer  another  huge  payoff:  they  promise  to  be 
powerful  enough  to  serve  any  other  part  of  the  planet. 

So  start  spinning  the  web  to  capitalize  on  the  biggest  market  in  the 
fastest-evolving  economic  region  on  Earth. 


www.investjapan.org/us 
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The  Japan  External  Trade  Organization  (JETRO)  is  a  Japanese  government-funded  organization  that 
promotes  trade  and  foreign  direct  investment  in  Japan. 

New  York  •  San  Francisco  •  Los  Angeles  •  Chicago  •  Houston  •  Atlanta 
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If  You  Cheat, 

You're  a  Cheater 

While  it’s  OK  to  exaggerate  or  underestimate 
your  golf  skills,  outright  cheating  is  just  plain 
wrong.  Many  knowledgeable  golfers  have  a 
sense  about  how  many  strokes  you  have 
taken  per  hole  and  can  spot  a  cheater  early 
on.  “People  think  they’re  being  subtle  about 
cheating,”  says  Guzman.  “And  cheating  may 
be  an  indicator  of  how  they  will  behave  in 
other  circumstances.”  CIOs  who  witness 
cheating  by  a  member  of  their  foursome 
shouldn’t  hesitate  to  bring  it  to  the  attention 
of  others  in  their  group,  so  long  as  the  group 
consists  of  peers.  However,  Woo  advises 
CIOs  to  think  twice  if  the  cheater  in  their 
midst  happens  to  be  a  CEO,  CFO  or  other 
senior  executive;  cheating  is  indicative  of 
some  degree  of  dishonesty,  so  CIOs  might 
wonder  how  trustworthy  their  bosses  are. 

Lose  the  Cell  Phone 

The  current  hot-button  issue  in  the  golfing 
world  is  mobile  technology.  While  some  golf 
courses  have  banned  the  use  of  cell  phones 
on  the  course,  many  golfers  still  take  and 
make  calls  between  shots.  “If  you  think  of  it 
as  a  business  meeting,  it’s  incredibly  rude,” 
says  Woo.  Perhaps  you  have  to  make  an 


important  call,  especially  if  you’re  golfing 
during  normal  business  hours.  The  best  bet, 
says  Woo,  is  to  warn  other  players  in  your 
group  that  you  may  have  to  use  your  cell 
phone,  and  then  try  to  do  so  when  it’s  most 
considerate— such  as  at  the  snack  bar  often 
located  at  the  ninth  hole.  Above  all,  common 
courtesy  dictates  turning  off  your  cell 
phone’s  ringer  so  that  it  doesn’t  sound  at 
inopportune  moments—  such  as  when  your 
CEO  is  attempting  a  match-winning  putt. 

Scott  Hicar,  CIO  of  storage  vendor  Maxtor, 
finds  other  devices  such  as  BlackBerrys  to 
be  equally  distracting.  lie  once  watched  in 
amazement  as  a  playing  partner  (a  fellow  IT 
exec)  at  a  charity  tournament  spent  most  of 
his  time  on  his  BlackBerry.  “On  the  tee  box, 
he  was  clicking  out  e-mails,  and  his  thumbs 
were  twiddling  away  as  we  were  hitting,” 
says  Hicar.  If  you’re  that  attached  to  your 
BlackBerry  and  the  office— what’s  the  point 
in  even  playing?  Your  miserable  day  will 
ruin  the  experience  for  everyone  else. 

The  key  to  any  successful  business  golf 
outing  lies  within  the  participants  and  their 
willingness  to  use  the  time  to  solidify  friend¬ 
ships  and  enjoy  social  relations  in  a  relaxed 
atmosphere.  But  don’t  presume  you’ll  dis¬ 
cover  business  nirvana  simply  because 


you’re  on  a  picturesque  golf  course  on  the 
company’s  dime.  “You  should  never  believe 
or  behave  in  a  way  in  which  you  think  you 
are  owed  business  because  of  a  golf  outing,” 
says  Guzman.  “This  is  an  investment  in  your 
relationship  regardless  of  whether  there  are 
any  immediate  business  results.” 

And  just  because  you’ve  heard  “business 
gets  done  on  the  golf  course,”  don’t  bother 
with  the  game  if  you  detest  it.  The  investment 
of  your  time  and  psyche  is  just  too  great.  “You 
won’t  be  able  to  get  away  with  saying  you  love 
it  when  you  are  hating  every  minute  of  it,” 
says  Woo.  Which  is  the  reason  why  golf 
bonds  businesspeople  like  few  other  interac¬ 
tions.  “You  know  each  other’s  pains  and  each 
other’s  victories,”  says  Woo.  E3I3 


Staff  Writer  Thomas  Wailgum  can  be  reached  at 
twa  /  lgum@cio.  com . 


Be  a  Player 


Or  just  look  like  one.  No,  in  this  case,  you'd  better 
Learn  the  Game.  Go  online  to  find  resources  to 
iearn  howto  play  as  well  as  a  short  quiz  for  those 
of  you  who  think  you  know  the  game.  OK;  Are 
you  allowed  to  spit  on  the  face  of  your  golf  ball? 
Go  to  the  online  version  of  this  article  or  to  www 
.cio.com/040105  for  the  link  to  “Learn  the  Game," 
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Can  your 
network 
transform  your 
business? 


EVOLVE  AT  WILL.  Can  your  network  turn  a  tight  race  into  a  commanding  lead?  Can  it 
move  quickly  into  global  markets,  help  drive  down  costs  and  be  nimble  in  the  face  of 
changing  competition?  Can  it  offer  both  ultra-flexible  IP-VPNs  and  business  continuity 
services?  Can  it  deliver  innovative  security  and  IP  management  expertise?  With 
networking  solutions  from  AT&T,  you  can  integrate  your  entire  value  chain  into  a  single, 
globally  networked  community.  So  not  only  will  your  enterprise  be  able  to  reach  the 
entire  world  — it  might  even  be  capable  of  changing  it.  CAN  YOUR  NETWORK  DO  THIS? 
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To  find  out  how  AT&T’s  networking  solutions 
can  help  evolve  the  way  you  do  business,  go  to: 

att.com/transform 
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Get  the  Biggest  Bang 
for  Your  SAP  Buck 


While  most  CIOs  would  tell 
us  that  ERP  implementa¬ 
tions  are  old  news,  the  CIO 
Executive  Council  fields  more  questions 
from  its  members  on  ERP  (SAP  in  par¬ 
ticular)  than  on  almost  any  other  topic. 
Training,  upgrades,  global  deploy¬ 
ments.  You  name  it;  CIOs  want  to  hear 
it.  And  they’re  interested  in  learning 
how  best  to  eke  out  as  much  ROI  as 
possible.  Last  fall,  the  Council  hosted  a 
teleconference  during  which  members 
(all  running  SAP)  traded  tips,  best 
practices  and  lessons  learned  on 
various  topics.  These  lessons  apply 
not  only  to  SAP  deployments  but  to 
most  enterprise  projects. 

Go  with  the  best.  A  project  as 
critical  as  ERP  needs  full  partici¬ 
pation  from  the  people  in  the  business 
who  know  their  processes  better  than 
anyone.  But  the  best  people  tend  to  be 
the  busiest.  “It  is  tempting  for  the  busi¬ 


ness  to  assign  the  most  available  people 
instead  of  the  best,”  says  Virginia 
Guthrie,  CIO  at  Coors  Brewing.  “So  I 
need  to  tell  the  CEO  that  without  the 
right  people,  I  do  not  advise  we  go  ahead 
with  the  project.  It’s  better  to  delay  it 
than  have  the  wrong  people  on  the  job.” 
Customize  training. 

Bob  Wittstein,  CIO  of 
Sappi  Fine  Paper  North 
America,  learned  the  hard 
way  the  value  of  training. 

At  a  former  company,  he  had 
invested  a  great  deal  in  class¬ 
room  training  for  his  cus¬ 
tomer  service  staff  so  that 
when  the  go-live  date  arrived, 
they  would  be  comfortable  with  the  sys¬ 
tem.  But  when  the  system  was  deployed, 
it  had  changed  significantly  since  train¬ 
ing.  The  new  screens  generated  some 
confusion  for  the  staff.  Wittstein  now 
mixes  traditional  classroom  training 


with  actual  practice  sessions  in  a 
go-live  environment. 

Dedicate  people  to  change 
management.  ERP  is  much 
more  than  a  new  technology;  it  is  a 
major  change  in  the  way  people  do  their 
jobs.  Never  underestimate  the  amount 
of  cultural  havoc  such 
change  can  wreak  on  an 
organization.  Walter  Weir, 
CIO  at  the  University  of 
Nebraska,  uses  a  dedicated 
change  management 
team— made  up  of  training 
specialists,  documentation 
specialists,  technician  sup¬ 
port  positions  and  a  change 
management  leader— to  work  closely 
with  the  SAP  implementation  teams 
and  campus  change  management  repre¬ 
sentatives  to  filter  information  to  the 
users.  Changes  that  affect  all  users— 
such  as  new  features,  functions,  bug 

Continued  on  Page  106 


BOB  WITTSTEIN 


How  to  Hire  and  Manage  a  Consultant 


A  consultant  can  make  or  break  an  ERP  deployment.  There 
fore,  hiring  well  and  managing  even  better  is  as  critical  as 
any  other  part  of  the  project.  Council  members  offer  their 
advice  for  selecting,  hiring  and  managing  a  consultant. 

□  specialization  is  best:  Hire  different  consul¬ 
tants  for  specific  modules  and  the  skills  required.  Use  these 
experts  to  fill  in  the  skills  that  you  lack  on  your  internal  staff. 

□  global  presence:  For  global  projects,  select 
consultants  who  know  the  specifics  of  particular  regions. 

□  AVOID  THE  YES-MAN:  CIOs  and  their  business 
peers  think  they  know  it  all;  a  consultant  has  to  be  able  to 
challenge  established  thinking  and  influence  behavior. 


□  EMBRACE  EARLY  TERMINATION:  Makesure 
the  statement  of  work  allows  for  early  termination.  If  a  consul¬ 
tant  is  not  working  out,  end  the  contract. 

□  BUILD  AN  AUDITION  INTO  THE  INTERVIEW: 

Present  the  candidate  with  a  real  configuration  scenario  to  test 
how  he  reacts  and  handles  the  situation. 

□  KEEP  MANAGEMENT  IN-HOUSE:  Don’t  give  up 
management  oversight  or  projects  to  consultants. 

□  watch  expenses:  Does  every  consultant  need  his 
own  rental  car?  Do  acceptable  lodging  arrangements  translate 
into  the  university  hotel  or  long-term  apartments?  Reviewing 
these  expenses  will  help  keep  the  consulting  budget  from 
breaking  the  bank. 
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JUST  BECAUSE  THE  SYSTEM  IS  DOWN 
DOESN’T  MEAN  THE  PEOPLE  USING  IT  SHOULD  BE. 


Constant,  uninterrupted  access  to  critical  data,  systems  and  people.  Even  when  something  goes  wrong.  That’s  Information  Availability.  And  one  of  the 
best  ways  to  virtually  guarantee  Information  Availability  is  by  running  your  production  systems  out  of  our  facilities.  You  manage  your  applications  and 
data  while  SunGard  Availability  Services  helps  to  ensure  that  the  infrastructure  and  technical  support  you  need  is  always  on.  SunGard  can  offer  a  secure 
and  scalable  environment  at  a  lower  operational  cost  for  production.  Plus  we  have  over  60  state-of-the-art  hardened  facilities  with  network, 
power  and  equipment  redundancies  that  are  unparalleled.  For  a  free  copy  of  the  IDC  White  Ol  INI  A  A  Keeping  People 

and  Information 

Paper:  “Ensuring  Information  Availability”  visit  www.availability.sungard.com/idcwp.  Availability  Services  Connected 
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SAP 


"SAP  is  a  living, 
breathing  monster. 
You  don't  implement 
it  and  then  walk 
away." 

-WALTER  WEIR, CIO, 

UNIVERSITY  OF  NEBRASKA 


get  the  biggest  bang  for  your  sap  buck,  Continued  from  Page  104 
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fixes  and  changes  in  business  processes— are  communicated  to  the 
user  community  through  the  centralized  group  so  that  a  consistent 
message  is  delivered,  improving  the  adoption  of  SAP  and  reducing 
the  level  of  confusion  and  incorrect  information  received.  Weir  also 
posts  a  change  management  specialist  on  each  of  the  four  campuses 
to  serve  as  contact  points  for  campus-specific  needs. 

Customize  tools  to  keep  users  educated.  Weir  cus- 
\  tomized  a  Lotus  Notes-based  application  that  helps  users 
quickly  locate  information  about  specific  rights  and  privileges, 
time  lines,  training  sessions  and  the  right  contact  person  on  the 
SAP  team.  This  centralized,  low-cost  tool  eliminates  the  need  for 
the  different  campuses  and  departments  to  create,  maintain  and 
support  their  own  change  management  technology  and  training 
sessions.  Weir  says  users  look  to  the  tool  for  up-to-date  information 
regarding  changes  to  SAP  and  business  doc¬ 
umentation  and  details  about  new  features. 

Work  strategically  with  your 
vendor.  CIOs  need  to  look  at  the 
vendor’s  business  from  a  strategic  perspec¬ 
tive,  says  Abbe  Mulders,  CIO  and  executive 
director  of  IT  and  KM  at  Dow  Corning. 

“We’ve  done  a  lot  of  relationship-building 
with  SAP  to  understand  its  strategy,  goals 
and  ambitions,”  she  says.  “We  also  work  to  influence  that  strategy 
so  that  what  goes  into  the  next  release,  both  technically  and  strate¬ 
gically,  will  help  our  business.” 

Run  plenty  of  tests.  If  you  skimp  on  testing  to  make  your 
O  J  go-live  date,  you  may  as  well  throw  away  your  money.  ‘All 
the  training  and  change  management  practices  won’t  be  enough  to 
save  a  project  that  is  deployed  before  testing  is  complete,”  says 
Wittstein.  He  stresses  the  importance  of  data  migration  testing  to 
validate  that  the  data  is  perfect  in  the  new  system  and  of  using 
metrics  to  catch  bad  data  trends  early  in  the  testing  period.  Guthrie 
concurs:  “Testing  servers  is  cheap  compared  with  an  unsuccessful 
SAP  go-live,”  she  says. 

Build  in  an  anchor.  At  Coors,  Guthrie  divides  enterprise 
projects  in  two:  the  deployment  itself  and  an  “anchoring” 
project,  complete  with  its  own  time  line  and  budget,  which  exists 
primarily  to  do  fine-tuning  after  deployment.  “We  plan  for  a  sec¬ 
ond  project  after  the  first  is  locked  down  to  do  cleanup,”  she  says. 
“We’re  investing  a  lot  in  the  system,  and  we  want  to  apply  what 
we’ve  learned  to  take  care  of  any  problems  right  away.” 
ft!  Create  a  team  of  super  users.  Bill  Haser,  CIO  at  Ten- 

neco  Automotive,  employs  a  super-user  university  concept 
in  all  divisions.  He  sees  value  especially  in  departments  with 
high  attrition  rates  where  new  employees  mean  more  training. 
Super  users  learn  the  system  inside  and  out  and  train  others 
through  ongoing  sessions.  These  users  answer  how-to  questions, 
develop  best  practices  and  identify  additional  training  needs. 

As  a  result,  the  whole  team  suffers  less  knowledge  loss  when  an 
employee  leaves. 

-Carrie  Mathews,  Member  Services  Manager,  CIO  Executive  Council 
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We  have  implemented 
80  percent  of  SAP  modules 
and  have  created  a  stag¬ 
gered  upgrade  strategy. 
VIRGINIA  GUTHRIE,  por  those  modules  that 
CIO,  Coors  Brewing  Co,  have  jess  process  ar|d  fewer 

users— such  as  business 

information  warehouse  and  advanced  planner  and 
optimizer— we  upgrade  every  18  months.  Modules  that 
are  important  but  will  not  affect  our  ability  to  make, 
ship  and  sell  beer  are  upgraded  every  three  years. 

Lastly,  for  the  core  modules,  we  upgrade  every  five 
years  due  to  the  disruptive  nature  of  an  upgrade.  We 
have  found  that  this  strategy  works  well  with  the  busi¬ 
ness,  is  less  onerous  and  is  less  costly  than  a  “big- 
bang”  upgrade. 


Within  the  main  ERP  system, 
I  would  never  consider  a 
module-by-module  upgrade, 
as  SAP  is  not  set  up  this  way. 
BILL  HASER,  However,  we  purposely 

CIO,  Tenneco  Automotive  dep|oyed  the  HR  module  on 

separate  servers  so  that  it 

can  be  upgraded  independently  of  the  main  system.  If 
you  think  you  will  need  to  upgrade  different  modules 
at  different  times,  then  you  should  consider  a  similar 
implementation  strategy. 


In  what  order  should  you 
upgrade  specific  SAP 
modules?  Why  is  this  con¬ 
sidered  the  best  strategy? 
And  what  effect  does  it  have  on  a 
successful  upgrade? 
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Introducing  the  SYSTIMAX® 
GigaSPEED®  XI OD  Solution,  the  UTP 
cabling  solution  that  empowers  your 
infrastructure  with  10G  performance. 


a  company 


When  was  the  last  time  you  looked  into  the  future?  SYSTIMAX  ®  Labs 
engineers  and  scientists  do  it  every  day,  and  they  see  a  world  dominated  by 
gigabit-hungry  applications  that  can  choke  throughput  and  cripple  today's 
networks.To  help  you  meet  the  future  on  its  own  bandwidth-intensive  terms, 
SYSTIMAX  ®  Solutions  has  developed  the  GigaSPEED®  XI  OD  Solution. 

A  comprehensive,  end-to-end  1 0G  UTP  cabling  solution,  the  GigaSPEED 
XI  OD  Solution  extends  the  performance  capabilities  of  your  network  with 
blazing  speed  and  bandwidth  to  spare.  Which  means  it  increases  your 
productivity  and  sharpens  your  competitive  edge.  So  bring  on  the  streaming 
media!  Bring  on  all  the  sophisticated  applications  the  future  will  unleash! 
With  the  visionary  GigaSPEED  X10D  Solution,  the  future  is  now.To  get  a 
head  start  on  tomorrow,  contact  SYSTIMAX  Solutions  today  at 
1-800-344-0223,  systimaxsolutions@systimax.com  orwww.systimax.com. 


SYSTIMAX^ 

SOLUTIONS 

C  2005  CommScope,  Inc. 

GigaSPEED®  XI OD  •  LazrSPEED  ®  •  TeraSPEED™  •  iPatch™  •  AirSPEED™ 
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[experience  base] 

Managing  the  Management  Team 

In  1998,  Scott  Hicar,  vice  president  of  worldwide  IT  and  CIO 
of  Maxtor,  implemented  a  single,  worldwide  instance  of  SAP 
for  roughly  1,000  users.  He  put  together  a  team  of  20  people 
to  drive  the  deployment  and  to  own  continuous  improvement. 

That  team  now  numbers  40  people  and  the  number  of  SAP 
users  has  grown  by  about  50  percent.  One  business  analyst 
and  three  or  four  IT  staffers  are  dedicated  to  each  major  func¬ 
tional  area  of  the  company:  financials,  HR,  materials  and  manu¬ 
facturing,  and  sales  and  distribution.  Each  sub-team  is 
responsible  for  ensuring  that  SAP  (as  well  as  all  other  applications)  is  delivering 
as  much  value  to  that  part  of  the  business  as  possible. 

But  what  seems  basic  in  theory  is  often  harder  in  practice.  Hicar  offers  three  lessons: 


SCOTT  HICAR 


Begin  with  func¬ 
tional  alignment. 
When  Hicar  formed  his 
team,  he  organized  it  func¬ 
tionally,  but  only  around 
SAP.  He  dedicated  other 
members  from  the  IT  staff 
to  focus  on  non-SAP 
applications.  Over  the 
next  four  years,  Hicar 
expanded  the  functional 
alignment  to  all  of  the 
applications  that  are  rele¬ 
vant  to  each  functional 
area.  If  he  were  to  do  it 
again,  says  Hicar,  “We 
would  move  more  quickly 
in  broadening  the  scope  of 
the  senior  business  ana¬ 
lyst  to  include  all  of  the 
systems  that  that  particu¬ 
lar  functional  group 
uses.”  Why?  The  broader 
the  technical  responsibil¬ 
ity  of  each  business  ana¬ 


lyst,  the  smarter  they  get 
about  the  business. 

Keep  an  eye  on  the 
midlevel  relation¬ 
ship.  When  selecting  IT 
people  to  head  each  func  ¬ 
tional  area,  Hicar  suggests 
focusing  on  relationship 
skills  as  much  as  technol¬ 
ogy  or  business  knowl¬ 
edge.  “It’s  all  about  the 
relationship  between  the 
business  systems  analyst 
and  the  business  unit 
manager,”  he  says.  “If  that 
dialogue  goes  well,  then 
my  dialogue  with  the 
executive  team  will  go 
well.  It’s  not  top  down,  it’s 
middle  up.”  lie  recom¬ 
mends  weekly  meetings 
between  business  analysts 
and  business  unit  heads 
to  review  priorities  and 
backlogs. 


Hire  business  ana¬ 
lysts  who  can  sell. 
Marketing  the  achieve  ¬ 
ments  of  an  SAP  invest¬ 
ment  is  no  easy  feat,  but  a 
critical  one.  Hicar  directs 
his  team  of  business  ana¬ 
lysts  to  find  some  simple 
ways  and  basic  metrics  to 
market  the  business’s  ROI. 
“We  have  a  new  manage¬ 
ment  team  at  Maxtor,  and 
they  are  not  as  familiar 
with  our  accomplishments 
as  the  old  team,”  says 
Hicar.  “We  wish  we  had 
developed  a  mind-set, 
from  the  beginning, 
around  documenting 
our  achievements,  since 
we  now  have  to  double 
our  efforts.” 

-Martha  Heller, 
Managing  Director, 
CIO  Executive  Council 


ROLE  PLAY 

Critical 

Players 

A  successful  SAP  implementation 
depends  on  having  the  right  team  in 
place  to  manage  the  process,  commu¬ 
nicate  with  the  business  users  and 
keep  the  project  on  track.  Council 
members  recommend  havingthe 
following  essential  players. 

•  Change  management  and  training 
and  documentation  specialist: 

Conduit  between  business  teams, 
users  and  IT  to  manage  training 

•  Project  accountant:  Serves  as  the 
face  of  the  project  to  the  board;  under¬ 
stands  the  business  risk  of  this  hugely 
expensive  investment 

•  Global  business  process  manager: 

Directs  and  prioritizes  business 
process  changes  throughout  the 
global  organization 

•  Enterprise  SAP  application 
architect:  Establishes  and  champions 
application  architecture  and  develop¬ 
ment  methodologies 

•  Acquisition  and  implementation 
manager:  Manages  ongoing  mainte¬ 
nance  and  enhancements  of  specific 
modules;  identifies  user  requirements 
and  effects  on  other  systems 

To  view  full  job  descriptions,  go  to 
the  online  version  of  this  article  at 
www.cio. com/040105. 


[ONE”LINER] 


"The  good  news  is  that  if  you  put  a  number  in  SAP,  it  goes  everywhere 
in  the  business;  i 


everywhere  in  the  business." 


The  CIO  Executive  Council  is  a  professional  organization  for  CIOs  founded  by  CIO’s  publisher.  To  learn  more  about  the  Council,  visit  www.cioexecutivecouncil.com 
or  contact  Managing  Director  Martha  Heller  at  mheller@cio.com  or  508  988-6738. 
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MEANS  A  NETWORK 

THAT  DOES  MORE. 


ProCurve  Networking  by  HP.  More  and  more  businesses  get  more  from  us. 

MORE  VALUE.  Our  solutions  typically  cost  less.  Much  less. 

MORE  SECURITY,  Our  products  can  help  detect  would-be  intruders  at  the  edge 
of  your  network — before  they  reach  the  core. 

MORE  OPEN,  We’re  interoperable.  That  means  easy  integration. 

MORE  INTELLIGENT.  Run  your  network  from  the  core.  Control  it  to  the  edge. 

MORE  SUPPORT.  Industry-leading  support.  Warranties  that  last  a  lifetime* 

MORE  RELIABLE.  Rigorously  tested.  Meticulously  engineered. 

MORE  EXPERIENCE.  We’ve  been  doing  this  for  25  years. 


Find  out  more  about  ProCurve  Networking.  Call  800-975-7684  Ref  Code  6  or 
download  informative  reports  complete  with  case  studies  and  cost-of-ownership 
analysis  at  www.hp.com/learn/procurve. 


ProCurve  Networking 


HP  Innovation 


•Lifetime  warranty  applies  to  all  ProCurve  products,  excluding  the  ProCurve  routing  switch  9300m  Series  and  Secure  Access 
700wl  Senes,  which  have  a  one-year  warranty  with  extensions  available.  ©2005  Hewlett-Packard  Development  Company,  L.P 
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Repeal 

Sarbanes-Oxley 

American  companies  are  spending  valuable  resources 
on  compliance  ratherthan  competition 

How  much  of  your  2005  budget  is  allocated  to 
meeting  Sarbanes-Oxley  regulations?  The  CIO 
Magazine  Tech  Poll  reports  that  nearly  half  of 
the  large  companies  surveyed  will  divert  more 
than  15  percent  of  their  budgets  to  Sarbanes- 
Oxley  compliance.  In  an  era  of  shrinking  IT 
budgets,  I  ask,  diverted  from  where? 

I  shared  this  figure  with  an  audience  in  a 
recent  speech  and  was  met  by  a  sea  of  heads  nod¬ 
ding  in  disgust.  Afterward,  a  CIO  said,  “I  make  a 
lot  of  sales  calls  and  never  once  have  I  heard  a  sales  rep  tout  to  a  prospective  cus¬ 
tomer  that  the  reason  we  should  do  business  is  because  we  are  more  compliant 
than  our  competition.” 

That  competition  is  coming  from  global  companies.  And  while  foreign  com¬ 
panies  are  free  to  grab  market  share,  U.S.  executives  are  instead  grabbing  their 
Sarbanes-Oxley  manuals  to  learn  how  to  “continuously  engage  business  man¬ 
agers  and  process  owners  in  self-assessment  training.”  Is  Dr.  Phil  in  the  house? 

Sarbanes-Oxley  was  a  political  overreaction  crafted  by  two  lawyers  who  never 
ran  a  business  in  their  careers.  While  executives  at  Enron,  Tyco  and  WorldCom 
(among  others)  have  behaved  criminally,  most  business  executives  who  manage  the 
more  than  6,000  publicly  traded  companies  are  solid  corporate  citizens  who  hon¬ 
estly  report  the  financial  results  of  their  companies.  And  now,  thanks  to  two 
lawyer-legislators,  executives  spend  more  time  with  auditors  than  with  customers. 

Sarbanes-Oxley  will  hurt  investors  in  the  long  run  because  it  forces  business 
executives  to  focus  on  policy  development  rather  than  product  development. 
Moreover,  Sarbanes-Oxley  will  offer  investors  fewer  choices;  CEOs  of  lightly 
traded  public  companies  will  opt  off  stock  market  exchanges  to  avoid  unneces¬ 
sary  compliance  expenses  while  their  counterparts  at  hot  private  companies 
will  remain  private  for  the  same  reason. 

Sarbanes-Oxley  needs  to  be  repealed.  In  a  recent  CIO.com  poll,  49  percent  of 
463  respondents  agreed.  Make  your  voice  heard.  I  will  send  all  responses  to  this 
column  to  Sen.  Paul  Sarbanes  and  Rep.  Michael  Oxley.  Write  me  today. 
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The  Resource 
for  Information 
Executives 


CIO  Executive  Council 

The  Professional  Organization  for  CIOs 


New 

Speakers 


Gary  Beach 

Group  Publisher,  CIO  Magazine 

Charles  S.  Brenner 

SVP,  Fidelity  Center  for 
Applied  Technology, 
Fidelity  Investments 

Janies  E.  Burdiss 

CIO,  Smurfit-Stone 
Container  Corp. 

Jeri  Dunn 

CIO,  Tyson  Foods  Inc. 

Martha  Heller 

Managing  Director, 

CIO  Executive  Council 

Christopher  Lindquist 

Technology  Editor, 

CIO  Magazine 

Abbie  Lundberg 

Editor  in  Chief,  CIO  Magazine 

Gerry  McCartney 

Assistant  Dean  for  Technology 
&  Senior  MIS  Lecturer,  Kran- 
nert  School  of  Management, 
Purdue  University 

Richard  Pastore 

Editor,  CIO  Magazine 

Steve  Peltzman 

CIO,  Museum  of  Modern  Art 

Steven  Strout 

CIO,  Morris 
Communications  Co. 

John  Von  Stein 

CIO,  Options  Clearing  Corp. 


am] 

SALES  AND  SERVICES 


CIO  SALES  OFFICES 

President  and  CEO 

Walter  Manninen  •  508  935-4101 

Publisher 

GaryJ.  Beach  •  508  935-4202 

Executive  VP  Sales/Custom  Publishing 

Ellen  Romanow  •  508  935-4796 

EAST  COAST 

Senior  Vice  President, 

Sales  and  Integrated  Solutions/East 

Joan  Kelly -508  935-4586 

Regional  Sales  Director 

Kathy  Powers  •  201 634-2331 

Regional  Sales  Manager 

Ellie  Schwab  •  201 634-2332 
District  Sales  Manager 
Andrew  Haney  •  508  988-7863 
Fax  •  508  879-6063 
Account  Executive 
Joan  Bonadeo  •  201 634-2328 
Senior  Sales  Associate 
Rhonda  Goodman  •  201 634-2329 
Fax  •  201 634-9513 

x  NEW  ENGLAND 

Senior  Vice  President, 

Sales  and  Integrated  Solutions/East 

Joan  Kelly  •  508  935-4586 

Account  Executive 

Dawn  Cora  •  508  935-4092 

SOUTH  CENTRAL 

Regional  Director/ Advertising  Sales 

Robert  E.  Sawdon  •  512  306-9801 
Account  Executive 

Brenda  Garza  •  512  306-9801 
Fax  •  512  306-9805 


NORTH  CENTRAL 

Senior  District  Sales  Manager 

Beth  DeVillez  •  847  759-2727 
Advertising  Sales  Associate 

Kim  Giovanni  •  847  759-2728 
Fax  •  847  759-2729 

WEST  COAST 

VP,  Sales  and  Integrated  Solutions/West 

Bob  Melk- 415-975-2685 
Senior  Regional  Sales  Managers 
Ai  Collins -415  975-2686 
Regional  Sales  Manager 
Kevin  Ebmeyer  •  415  975-2684 
Account  Executive 
Derek  Jung -415  975-2683 
Fax  •  415  543-2358 
Senior  Sales  Associate 
Sara  Mascall  •  415  978-3385 

SOUTHERN  CALIFORNIA 

Regional  Sales  Manager 

Kevin  Ebmeyer  •  415  975-2684 

LIST  SERVICES 

List  Services  Director 

Kathryn  A.W.  Marston  •  508  935-4072 

List  Services  Account  Executive 

Stephanie  Roy  •  508  935-4151 

ONLINE  SERVICES 

VP/Online  Sales 

Lisa  Brown  •  508  935-4470 
Online  Sales  Manager 

Michael  McPhee  •  508  935-4611 


CUSTOM  PUBLISHING 

Group  Director 

Michael  Siggins  •  508  988-6763 
Director  Mary  Gregory  •  508  988-6765 

Director  of  Content  Development  Tom  Field 
Assoc.  Director  of  Content  Development 

Anne  Stuart 

Senior  Project  Manager  Amy  Greenleaf 
Project  Managers  John  Danielowich, 

Jon  Heinrich 

REPRINT  SERVICES 

For  article  reprints  (500  quantity  or  more), 
please  contact  Jesse  Levy  at  PARS 
International  (212  221-9595  xl23)  or 
via  e-mail  at  jesse@parsintl.com. 

CIO  IS  PUBLISHED  IN  THE 
U.S.  AS  WELL  AS  IN: 

Australia,  CIO  Australia  www.idg.com.au 
Canada,  CIO  Canada  www.lti.on.ca/cio 
China,  CEO  &  CIO  China  www.ceocio.com.cn 
France,  CIO  France  www.idg.fr/cio 
Germany,  CIO  Germany  www.cio.de 
India,  CIO  India  91-80-521-0309/12 
Japan,  CIO  Japan  www.idg.co.jp 
The  Netherlands,  CIO  Netherlands  www.cio.ni 
New  Zealand,  CIO  New  Zealand  www.idg.co.nz 
Norway,  CIO  Business  Standard 
www.business-standard.no 
Poland,  CXO  Poland  www.cxo.pl 
Singapore,  CIO  ACEN/Hong-Kong 
www.idg.com.  sg 

South  Korea,  CIO  Korea  www.cio.seoul.kr 
Sweden,  CIO  Sweden  www.cio.idg.se 

For  further  sales  information,  visit 

www2.cio.com/marketing/aboutcio/ 

contacts.cfm. 


INDEX  OF  COMPANIES  AND  ADVERTISERS 


Page  numbers  refer  to  the  first  page  of  the  article(s)  in  which  the  company  has  a  substantial  mention. 

This  index  is  provided  as  a  service  to  readers.  The  publisher  does  not  assume  any  liability  for  errors  or  omissions. 


COMPANY  INDEX 

INPUT  Inc . 

.  21 

ADVERTISER 

INDEX 

Intel  Corp . 

.  2,  28a 

JotSpot  Inc . 

.  21 

InterSystems  Corp . 

.  ...  27 

American  International  Group  Inc. 

Maxtor  Corp . 98, 104 

Adobe  Systems  Inc. 

. 12 

Japan  External  Trade  Organization 

.  21 

Megadata  Corp . 

.  21 

Akamai  Technologies  Inc.  ...  45 

(JETRO)  . 

...  101 

BizGolf  Dynamics . 

.  98 

Old  Dominion  Freight  Line  Inc. 

American  Power  Conversion 

Lawson  Software  . 

....  11 

Business  Golf  Academy,  The 

.  62 

. 25 

Microsoft  Corp . 

. . .  C2 

.  98 

Opsware  Inc . 

.  21 

AT&T . 

. 103 

Motorola  Inc.  (regional)  . 

...  90 

Business  Golf  Strategies  Inc. 

Oracle  Corp . 

.  70 

Brother  International 

. 49 

MRO  Software  Inc . 

.  ...  61 

.  98 

Russell  Reynolds  Associates 

Cingular  Wireless .  .  . 

. 28a 

NetlQ  Corp . 

. 4 

Cassatt  Corp . 

.  21 

.  42 

Cisco  Systems  Inc.  . 

. C3 

Oracle  Corp . 

.  ...  39 

Consilium  Consulting  Inc.  . . 

.  70 

Sappi  Fine  Paper  North  America 

Citrix  Systems  "Inc.  . 

. 31 

Primavera  Systems  Inc. 

. ...  35 

Coors  Brewing  Co . 

104 

104 

Cognos  Inc . 

. 9 

Resources  Global  Professionals 

craigslist  . 

.  21 

Target  Corp . 

.  38 

CXO  Media  Inc.  .  .  . 

29,  36,  56a, 

.  ...  23 

DHL  Worldwide  Network  S.A./N.V. 

Tenneco  Automotive  Inc.  . .  . 

104 

57,  76,  78,  80,  92a,  93,  111,  112 

Riverbed  Technology  Inc. 

....  15 

.  21 

Tiburon  Inc . 

.  70 

Dell  Inc . 

. 77,  79 

SAS . 

. ...  20 

Dow  Corning  Corp . 

104 

Trader  Joe's  Co.  Inc . 

.  38 

EMC2  Corp . 

.  .  65,  67,  69 

Softtek . 

. ...  47 

eBay  Inc . 

.32 

Tribe  Networks  Inc . 

.  21 

F5  Networks  Inc.  . . 

. 17 

SunGard  Availability  Services 

FedEx . 

.  81 

United  Parcel  Service  Inc.  .  . 

.  21 

Fujitsu  Computer  Systems  Corp. 

.  .  .  105 

Food  Service  Solutions  Inc. 

Verizon  Communications  Inc. 

. 59 

Sybari  Software . 

....  41 

.  21 

.  52 

Hewlett-Packard  Co. 

. 109 

Sybase  . 

...28a 

ForeSee  Results  Inc . 

.  21 

Whole  Foods  Market  Inc.  .  . . 

.  38 

Humane  Society  of  the  United 

Systimax  . 

...  107 

Freddie  Mac . 

.21 

Yankee  Group,  The  . 

.  98 

States,  The  . 

. 115 

Tripwire  Inc.  (regional)  . 

. ...  37 

General  Council  of  the  Assemblies 

IBM  Corp.  ...  18,  33,  73,  95,  97 

VeriSign  Inc . 

.  ...  89 

of  God,  The  . 

.91 

In  Focus . 

. 75 

Veritas . 

, . .  .  C4 

Home  Depot  Inc.,  The  ...  38,  70 

infoUSA.com  Inc.  . 

. 6 

Xerox  Corp . 

.  82,  87 

114  APRIL  1,  2005 

|  www.cio.com 

CIO  CONTACT 
INFORMATION 

Editorial,  Advertising  and  Business 
Offices:  CXO  Media  Inc.,  492  Old 
Connecticut  Path,  P.O.  Box  9208, 
Framingham,  MA  01701-9208, 

508  872-0080. 

CIO  (ISSN  0894-9301)  is  published 
semimonthly  and  as  a  combined 
issue  Dec.  15/Jan.  1  by  CXO  Media 
Inc.  Periodicals  postage  paid  at 
Framingham,  MA,  and  at  additional 
mailing  offices.  Canada  Publications 
Mail  Agreement  Number  1902075. 
CANADIAN  POSTMASTER:  Please 
return  undeliverable  copy  to  P.O.  Box 
1632,  Windsor,  ON  N9A7C9. 

Permissions:  Copyright  2005  by 
CXO  Media  Inc.  All  rights  reserved. 
Reproduction  of  material  appearing 
in  CIO  is  forbidden  without  written 
permission.  Send  all  requests  to 
Permissions  Department,  CIO, 

492  Old  Connecticut  Path, 

P.O.  Box  9208,  Framingham,  MA 
01701-9208. 

Photocopy  Rights:  Permission  to 
photocopy  for  internal  or  personal 
use  or  the  internal  or  personal  use  of 
specific  clients  is  granted  by  CIO  for 
users  through  the  Copyright  Clear¬ 
ance  Center,  provided  that  the  base 
fee  of  $3  per  copy  of  the  article,  plus 
$.50  per  page  is  paid  directly  to 
Copyright  Clearance  Center,  27 
Congress  Street,  Salem,  MA  01970. 
Please  specify:  ISSN  0894-9301. 
Permission  to  photocopy  does  not 
extend  to  contributed  articles 
followed  by  this  symbol:  $. 

Subscriptions:  CIO  is  free  to 

qualified  information  executives.  To 
apply,  use  our  online  subscription 
form  at  www.subscribe.cio.com. 
Subscriptions  are  also  available  on  a 
paid  basis  at  a  rate  of  $95  for  the 
United  States  and  Canada,  $195 
International  (payable  in  U.S.  funds 
only)  and  may  be  ordered  online  at 
www.  subscribe,  cio.  com/services,  html. 
Or  address  inquiries  to  CIO,  P.O. 

Box 489,  Northbrook,  IL  60065- 
0489:  866  354-1125.  Please  allow 
four  to  six  weeks  for  a  new  subscrip¬ 
tion  to  begin.  The  single  copy  price 
Is  $9  for  the  United  States  and 
Canada,  and  $15  International. 
Prepayment  is  required,  payable  in 
U.S.  funds. 

Change  of  Address:  Please  go  to 
www.omeda.com/custsrv/cio  and 
follow  the  online  instructions. 

Postmaster:  Send  change  of 
address  to  CIO,  P.O.  Box  489, 
Northbrook,  IL  60065-9816. 

Printed  in  the  U.S. A. 


1  1  4 


OF  THE  UNITED  STATES. 

2100  L  Street,  NW,  Washington,  DC  20037 
202-452-1100  •  www.hsus.org 


©  Ron  Burns 
**  www.ronburns.coni 

Ron  Burns  is  Artist  in  Residence  for; 
The  Humane  Society  of  the  United  Stal*^ 


04.01.05 


SPECIAL  REPORT: 

The  State  of  the  CIO  2005 


42  |  REALITY  CHECK 

AS  A  CIO  TODAY,  you’re  under  pressure  to 
reduce  costs.  At  the  same  time,  you’re  being 
told  to  use  IT  to  innovate  and  create  com¬ 
petitive  advantage.  Tough,  isn’t  it?  In  this 
“State  of  the  CIO”  report,  we  hit  the  road  to 
profile  three  very  different  CIOs,  each  work¬ 
ing  under  different  constraints.  This  immer¬ 
sion  in  the  daily  life  of  the  CIO  provides  a 
window  into  the  philosophy  and  mechanics 
of  innovation  and  a  reality  check  on  the  state 
of  the  CIO.  In  addition,  we’ve  included  a  new 
survey  on  innovation  and  the  CIO’s  role  in 
driving  it.  By  E/ana  Varon 

52 | SLEEPLESS 
IN  MANHATTAN 

CONTINUOUS  INNOVATION  is  Verizon  CIO 
Shaygan  Kheradpir’s  obsession.  He  manages 
his  almost  9,000-person  IT  organization 
much  like  a  grad-school  lab,  a  fraternity  of 


62  |  EVERYONE  WANTS 
SOMETHING  FROM  KEN 

FOR  KEN  ERDNER,  vice  president  of  tech¬ 
nology  and  information  services  at  Old 
Dominion  Freight  Lines,  work  means  jug¬ 
gling  the  often  contradictory  demands  of 
diverse  constituencies.  The  owners  like  to 
run  the  company  in  their  own  way.  But  the 
shareholders  expect  not  only  a  good  return 
on  investment  but  also  a  strict  adherence  to 
federal  regulations.  The  president  wants  his 
company  to  be  as  technologically  innova¬ 
tive  as  its  Fortune  500  competition,  but  the 
IT  department  is  supposed  to  do  so  on  one 
of  the  industry’s  leaner  diets.  In  this  profile, 
we  learn  how  Erdner  copes  and  how  he 
meets  his  company’s  rapidly  increasing  IT 
needs  with  relatively  minimal  resources, 
lots  of  hard  work,  a  good  sense  of  humor 
and  a  strong  sense  of  purpose. 

By  Stephanie  Overby 


lethargy  (endemic  to  government)  that  dis¬ 
courages  innovation.  He  also  worries  about 
his  staff’s  age:  A  quarter  of  his  145  employees 
will  be  eligible  for  retirement  in  the  next  two 
years.  And  then,  there’s  money.  Right  now, 
Taylor  has  10  unfilled  positions  because  until 
recently  he’d  been  operating  under  a  hiring 
freeze.  In  this  up-close  profile,  we  see  how 
Taylor  battles  for  resources,  tries  to  drive  cul¬ 
tural  change  and  convinces  elected  officials 
of  IT’s  value  in  his  quest  to  make  Fulton  one  of 
the  leading  IT-managed  counties  in  the  nation. 

By  Allan  Holmes 

81  |  THE  IDEAL 
AND  THE  REALITY 

THE  IDEAL  CIO  POSITION-the  one  that 
will  bring  the  most  benefit  to  the  most  com¬ 
panies— is  defined  by  a  set  of  responsibili¬ 
ties,  accountabilities  and  essential  skills. 
We’ve  collected  these  elements  and  format- 


Shaygan  Kheradpir, 
Verizon 


Ken  Erdner,  Robert  Taylor, 

Old  Dominion  Freight  Lines  Fulton  County,  Ga. 


smart  people  who  welcome  the  long,  crazy 
hours  developing  Verizon  systems  and  prod¬ 
ucts.  Equally  demanding  of  himself,  Kherad¬ 
pir  puts  in  10  or  12  hours  at  the  office  and  then 
goes  back  online  from  home  every  night  for 
three  or  four  more  hours.  To  achieve  Verizon’s 
goal  of  being  the  leading  provider  of  digital 
services  to  the  home,  Kheradpir  has  adapted 
a  process  borrowed  from  the  venture  capital 
world— fast  prototyping  in  30-day  cycles. 
With  this  discipline,  he  can  tweak  products  as 
they  are  being  developed.  By  Alice  Dragoon 


70  |  WHERE  THERE'S 
A  PERSON,  THERE'S 
A  PROBLEM 

ROBERT  TAYLOR,  CIO  for  Fulton  County, 
Ga.,  has  implemented  the  county’s  first  IT 
security  plan,  updated  and  upgraded  the 
county’s  hardware  and  software,  and  secured 
a  seat  at  the  county  management  table— the 
first  Fulton  County  CIO  to  do  so.  But  he  wor¬ 
ries  constantly  about  the  many  people  on  his 
staff  who  lack  project  management  and  tech¬ 
nology  skills  and  suffer  from  the  bureaucratic 


ted  them  as  a  CIO  “job  spec”  from  a  hypo¬ 
thetical  company,  drawing  on  data  from 
many  studies,  and  from  extensive  input 
from  CIOs  and  executive  recruiters. 

It’s  one  thing  to  know  the  ideal;  it’s 
another  to  see  how  you.  compare.  So  we’ve 
included  a  self-assessment  test.  See  how 
you  stack  up  against  the  ideal.  IT  leaders 
(and  the  executives  who  hire  them)  can  use 
both  the  specification  and  the  test  as  guides 
for  assessing  and  refining  the  CIO  role. 

By  The  Editors 


116 


APRIL  1,  2005  |  www.cio.com 


PHOTOS  BY  STEVEN  VOTE;  PHOTO  (LEFT)  BY  CATRINA  GENOVESE 


BECAUSE  HYBRID  IS 
ACTUALLY  NOT  A  SOLUTION. 

(EXCEPT  FOR  CARS.) 


Hybrid  is  as  hybrid  does.  And  when  it  comes  to  IP  Communications,  hybrid  doesn't  do  much  more  than  compromise.  Hybrid  doesn't 
do  seamless  failover.  Doesn't  do  scalability.  Doesn't  do  end-to-end  security.  Ditto  for  remote  upgrades.  So  if  it's  a  car,  go  hybrid.  But 
if  it's  a  networking  and  communications  strategy  you're  driving,  make  sure  you  drive  the  integrated,  secure,  end-to-end  solution: 
To  learn  more  about  Cisco  IP  Communications  solutions  or  to  find  a  service  provider  that  offers  these  managed  services  over  a 

Cisco  Powered  Network,  visit  cisco.com/domore.  COMMUNICATION.  THE  NEW  FASHIONED  WAY.  CISCO  IP  COMMUNICATIONS 
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COMPLIANCE  ISSUES? 

Today’s  regulatory  environment  doesn’t  leave  much  wiggle  room.  VERITAS  can  help  make  your  compliance  practices 
much  more  manageable.  99%  of  the  FORTUNE  500®  already  rely  on  VERITAS.  Software  for  Utility  Computing,  veritas.com 


©  2005  VERITAS  Software  Corporation.  All  rights  reserved.  VERITAS  and  the  VERITAS  Logo  are  trademarks  or  registered  trademarks  of  VERITAS  Softw  are  Corporation 

or  its  affiliates  in  the  U.S.  and  other  countries.  Other  names  may  be  trademarks  of  their  respective  ow  ners. 


